From: Greg Kroah-Hartman Date: Thu, 16 Jan 2020 23:04:40 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.14.166~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ecff69093a0b884b9bd8d871f2bd8700d04d29b5;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: af_unix-add-compat_ioctl-support.patch arm-8943-1-fix-topology-setup-in-case-of-cpu-hotplug-for-config_sched_mc.patch arm64-dts-apq8096-db820c-increase-load-on-l21-for-sdcard.patch compat_ioctl-handle-siocoutqnsd.patch f2fs-fix-potential-overflow.patch gfs2-add-compat_ioctl-support.patch iommu-mediatek-add-a-new-tlb_lock-for-tlb_flush.patch iommu-mediatek-correct-the-flush_iotlb_all-callback.patch iwlwifi-mvm-consider-ieee80211-station-max-amsdu-value.patch iwlwifi-mvm-fix-support-for-single-antenna-diversity.patch media-aspeed-video-fix-memory-leaks-in-aspeed_video_probe.patch media-cedrus-use-correct-h264-8x8-scaling-list.patch media-coda-fix-deadlock-between-decoder-picture-run-and-start-command.patch media-exynos4-is-fix-recursive-locking-in-isp_video_release.patch media-hantro-do-not-reorder-h264-scaling-list.patch media-hantro-h264-fix-the-frame_num-wraparound-case.patch media-hantro-set-h264-fieldpic_flag_e-flag-correctly.patch media-ov6650-fix-.get_fmt-v4l2_subdev_format_try-support.patch media-ov6650-fix-default-format-not-applied-on-device-probe.patch media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch media-ov6650-fix-some-format-attributes-not-under-control.patch media-rcar-vin-fix-incorrect-return-statement-in-rvin_try_format.patch media-v4l-cadence-fix-how-unsued-lanes-are-handled-in-csi2rx_start.patch memory-mtk-smi-add-pm-suspend-and-resume-ops.patch mips-loongson-fix-return-value-of-loongson_hwmon_init.patch mips-pci-remember-nasid-changed-by-set-interrupt-affinity.patch mips-sgi-ip27-fix-crash-when-cpus-are-disabled-via-nr_cpus-parameter.patch mtd-spi-nor-fix-silent-truncation-in-spi_nor_read.patch mtd-spi-nor-fix-silent-truncation-in-spi_nor_read_raw.patch nfsd-fixing-possible-null-pointer-derefering-in-copy-offload.patch pci-aardvark-fix-pci_exp_rtctl-register-configuration.patch pci-aardvark-use-ltssm-state-to-build-link-training-flag.patch pci-dwc-fix-find_next_bit-usage.patch pci-fix-missing-bridge-dma_ranges-resource-list-cleanup.patch pci-pm-clear-pcie-pme-status-even-for-legacy-power-management.patch pci-ptm-remove-spurious-d-from-granularity-message.patch powerpc-powernv-disable-native-pcie-port-management.patch revert-ubifs-fix-memory-leak-bug-in-alloc_ubifs_info-error-path.patch rtc-bd70528-add-module-alias-to-autoload-module.patch rtc-brcmstb-waketimer-add-missed-clk_disable_unprepare.patch rtc-msm6242-fix-reading-of-10-hour-digit.patch rtlwifi-remove-unnecessary-null-check-in-rtl_regd_init.patch sch_cake-add-missing-nla-policy-entry-tca_cake_split_gso.patch scsi-sd-enable-compat-ioctls-for-sed-opal.patch spi-atmel-fix-handling-of-cs_change-set-on-non-last-xfer.patch spi-lpspi-fix-memory-leak-in-fsl_lpspi_probe.patch spi-pxa2xx-set-controller-max_transfer_size-in-dma-mode.patch spi-rspi-use-platform_get_irq_byname_optional-for-optional-irqs.patch spi-sprd-fix-the-incorrect-spi-register.patch tools-pci-fix-fd-leakage.patch tty-serial-imx-use-the-sg-count-from-dma_map_sg.patch tty-serial-pch_uart-correct-usage-of-dma_unmap_sg.patch ubifs-do_kill_orphans-fix-a-memory-leak-bug.patch ubifs-fixed-missed-le64_to_cpu-in-journal.patch --- diff --git a/queue-5.4/af_unix-add-compat_ioctl-support.patch b/queue-5.4/af_unix-add-compat_ioctl-support.patch new file mode 100644 index 00000000000..6b7dd510169 --- /dev/null +++ b/queue-5.4/af_unix-add-compat_ioctl-support.patch @@ -0,0 +1,85 @@ +From 5f6beb9e0f633f3cc845cdd67973c506372931b4 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 3 Jun 2019 22:03:44 +0200 +Subject: af_unix: add compat_ioctl support + +From: Arnd Bergmann + +commit 5f6beb9e0f633f3cc845cdd67973c506372931b4 upstream. + +The af_unix protocol family has a custom ioctl command (inexplicibly +based on SIOCPROTOPRIVATE), but never had a compat_ioctl handler for +32-bit applications. + +Since all commands are compatible here, add a trivial wrapper that +performs the compat_ptr() conversion for SIOCOUTQ/SIOCINQ. SIOCUNIXFILE +does not use the argument, but it doesn't hurt to also use compat_ptr() +here. + +Fixes: ba94f3088b79 ("unix: add ioctl to open a unix socket file with O_PATH") +Cc: netdev@vger.kernel.org +Cc: "David S. Miller" +Cc: Eric Dumazet +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/unix/af_unix.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -646,6 +646,9 @@ static __poll_t unix_poll(struct file *, + static __poll_t unix_dgram_poll(struct file *, struct socket *, + poll_table *); + static int unix_ioctl(struct socket *, unsigned int, unsigned long); ++#ifdef CONFIG_COMPAT ++static int unix_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg); ++#endif + static int unix_shutdown(struct socket *, int); + static int unix_stream_sendmsg(struct socket *, struct msghdr *, size_t); + static int unix_stream_recvmsg(struct socket *, struct msghdr *, size_t, int); +@@ -687,6 +690,9 @@ static const struct proto_ops unix_strea + .getname = unix_getname, + .poll = unix_poll, + .ioctl = unix_ioctl, ++#ifdef CONFIG_COMPAT ++ .compat_ioctl = unix_compat_ioctl, ++#endif + .listen = unix_listen, + .shutdown = unix_shutdown, + .setsockopt = sock_no_setsockopt, +@@ -710,6 +716,9 @@ static const struct proto_ops unix_dgram + .getname = unix_getname, + .poll = unix_dgram_poll, + .ioctl = unix_ioctl, ++#ifdef CONFIG_COMPAT ++ .compat_ioctl = unix_compat_ioctl, ++#endif + .listen = sock_no_listen, + .shutdown = unix_shutdown, + .setsockopt = sock_no_setsockopt, +@@ -732,6 +741,9 @@ static const struct proto_ops unix_seqpa + .getname = unix_getname, + .poll = unix_dgram_poll, + .ioctl = unix_ioctl, ++#ifdef CONFIG_COMPAT ++ .compat_ioctl = unix_compat_ioctl, ++#endif + .listen = unix_listen, + .shutdown = unix_shutdown, + .setsockopt = sock_no_setsockopt, +@@ -2582,6 +2594,13 @@ static int unix_ioctl(struct socket *soc + return err; + } + ++#ifdef CONFIG_COMPAT ++static int unix_compat_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) ++{ ++ return unix_ioctl(sock, cmd, (unsigned long)compat_ptr(arg)); ++} ++#endif ++ + static __poll_t unix_poll(struct file *file, struct socket *sock, poll_table *wait) + { + struct sock *sk = sock->sk; diff --git a/queue-5.4/arm-8943-1-fix-topology-setup-in-case-of-cpu-hotplug-for-config_sched_mc.patch b/queue-5.4/arm-8943-1-fix-topology-setup-in-case-of-cpu-hotplug-for-config_sched_mc.patch new file mode 100644 index 00000000000..e4de7a54fa7 --- /dev/null +++ b/queue-5.4/arm-8943-1-fix-topology-setup-in-case-of-cpu-hotplug-for-config_sched_mc.patch @@ -0,0 +1,113 @@ +From ff98a5f624d2910de050f1fc7f2a32769da86b51 Mon Sep 17 00:00:00 2001 +From: Dietmar Eggemann +Date: Fri, 29 Nov 2019 16:23:02 +0100 +Subject: ARM: 8943/1: Fix topology setup in case of CPU hotplug for CONFIG_SCHED_MC + +From: Dietmar Eggemann + +commit ff98a5f624d2910de050f1fc7f2a32769da86b51 upstream. + +Commit ca74b316df96 ("arm: Use common cpu_topology structure and +functions.") changed cpu_coregroup_mask() from the ARM32 specific +implementation in arch/arm/include/asm/topology.h to the one shared +with ARM64 and RISCV in drivers/base/arch_topology.c. + +Currently on ARM32 (TC2 w/ CONFIG_SCHED_MC) the task scheduler setup +code (w/ CONFIG_SCHED_DEBUG) shows this during CPU hotplug: + + ERROR: groups don't span domain->span + +It happens to CPUs of the cluster of the CPU which gets hot-plugged +out on scheduler domain MC. + +Turns out that the shared cpu_coregroup_mask() requires that the +hot-plugged CPU is removed from the core_sibling mask via +remove_cpu_topology(). Otherwise the 'is core_sibling subset of +cpumask_of_node()' doesn't work. In this case the task scheduler has to +deal with cpumask_of_node instead of core_sibling which is wrong on +scheduler domain MC. + +e.g. CPU3 hot-plugged out on TC2 [cluster0: 0,3-4 cluster1: 1-2]: + + cpu_coregroup_mask(): CPU3 cpumask_of_node=0-2,4 core_sibling=0,3-4 + ^ +should be: + + cpu_coregroup_mask(): CPU3 cpumask_of_node=0-2,4 core_sibling=0,4 + +Add remove_cpu_topology() to __cpu_disable() to remove the CPU from the +topology masks in case of a CPU hotplug out operation. + +At the same time tweak store_cpu_topology() slightly so it will call +update_siblings_masks() in case of CPU hotplug in operation via +secondary_start_kernel()->smp_store_cpu_info(). + +This aligns the ARM32 implementation with the ARM64 one. + +Guarding remove_cpu_topology() with CONFIG_GENERIC_ARCH_TOPOLOGY is +necessary since some Arm32 defconfigs (aspeed_g5_defconfig, +milbeaut_m10v_defconfig, spear13xx_defconfig) specify an explicit + + # CONFIG_ARM_CPU_TOPOLOGY is not set + +w/ ./arch/arm/Kconfig: select GENERIC_ARCH_TOPOLOGY if ARM_CPU_TOPOLOGY + +Fixes: ca74b316df96 ("arm: Use common cpu_topology structure and functions") +Reviewed-by: Sudeep Holla +Reviewed-by: Lukasz Luba +Tested-by: Lukasz Luba +Tested-by: Ondrej Jirman +Signed-off-by: Dietmar Eggemann +Signed-off-by: Russell King +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/kernel/smp.c | 4 ++++ + arch/arm/kernel/topology.c | 10 +++++----- + 2 files changed, 9 insertions(+), 5 deletions(-) + +--- a/arch/arm/kernel/smp.c ++++ b/arch/arm/kernel/smp.c +@@ -240,6 +240,10 @@ int __cpu_disable(void) + if (ret) + return ret; + ++#ifdef CONFIG_GENERIC_ARCH_TOPOLOGY ++ remove_cpu_topology(cpu); ++#endif ++ + /* + * Take this CPU offline. Once we clear this, we can't return, + * and we must not schedule until we're ready to give up the cpu. +--- a/arch/arm/kernel/topology.c ++++ b/arch/arm/kernel/topology.c +@@ -196,9 +196,8 @@ void store_cpu_topology(unsigned int cpu + struct cpu_topology *cpuid_topo = &cpu_topology[cpuid]; + unsigned int mpidr; + +- /* If the cpu topology has been already set, just return */ +- if (cpuid_topo->core_id != -1) +- return; ++ if (cpuid_topo->package_id != -1) ++ goto topology_populated; + + mpidr = read_cpuid_mpidr(); + +@@ -231,14 +230,15 @@ void store_cpu_topology(unsigned int cpu + cpuid_topo->package_id = -1; + } + +- update_siblings_masks(cpuid); +- + update_cpu_capacity(cpuid); + + pr_info("CPU%u: thread %d, cpu %d, socket %d, mpidr %x\n", + cpuid, cpu_topology[cpuid].thread_id, + cpu_topology[cpuid].core_id, + cpu_topology[cpuid].package_id, mpidr); ++ ++topology_populated: ++ update_siblings_masks(cpuid); + } + + static inline int cpu_corepower_flags(void) diff --git a/queue-5.4/arm64-dts-apq8096-db820c-increase-load-on-l21-for-sdcard.patch b/queue-5.4/arm64-dts-apq8096-db820c-increase-load-on-l21-for-sdcard.patch new file mode 100644 index 00000000000..c320545f761 --- /dev/null +++ b/queue-5.4/arm64-dts-apq8096-db820c-increase-load-on-l21-for-sdcard.patch @@ -0,0 +1,35 @@ +From e38161bd325ea541ef2f258d8e28281077dde524 Mon Sep 17 00:00:00 2001 +From: Loic Poulain +Date: Wed, 12 Dec 2018 18:13:26 +0100 +Subject: arm64: dts: apq8096-db820c: Increase load on l21 for SDCARD + +From: Loic Poulain + +commit e38161bd325ea541ef2f258d8e28281077dde524 upstream. + +In the same way as for msm8974-hammerhead, l21 load, used for SDCARD +VMMC, needs to be increased in order to prevent any voltage drop issues +(due to limited current) happening with some SDCARDS or during specific +operations (e.g. write). + +Reviewed-by: Bjorn Andersson +Fixes: 660a9763c6a9 (arm64: dts: qcom: db820c: Add pm8994 regulator node) +Signed-off-by: Loic Poulain +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8096-db820c.dtsi +@@ -623,6 +623,8 @@ + l21 { + regulator-min-microvolt = <2950000>; + regulator-max-microvolt = <2950000>; ++ regulator-allow-set-load; ++ regulator-system-load = <200000>; + }; + l22 { + regulator-min-microvolt = <3300000>; diff --git a/queue-5.4/compat_ioctl-handle-siocoutqnsd.patch b/queue-5.4/compat_ioctl-handle-siocoutqnsd.patch new file mode 100644 index 00000000000..e0057e6e281 --- /dev/null +++ b/queue-5.4/compat_ioctl-handle-siocoutqnsd.patch @@ -0,0 +1,34 @@ +From 9d7bf41fafa5b5ddd4c13eb39446b0045f0a8167 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 3 Jun 2019 23:06:00 +0200 +Subject: compat_ioctl: handle SIOCOUTQNSD + +From: Arnd Bergmann + +commit 9d7bf41fafa5b5ddd4c13eb39446b0045f0a8167 upstream. + +Unlike the normal SIOCOUTQ, SIOCOUTQNSD was never handled in compat +mode. Add it to the common socket compat handler along with similar +ones. + +Fixes: 2f4e1b397097 ("tcp: ioctl type SIOCOUTQNSD returns amount of data not sent") +Cc: Eric Dumazet +Cc: netdev@vger.kernel.org +Cc: "David S. Miller" +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + net/socket.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/socket.c ++++ b/net/socket.c +@@ -3532,6 +3532,7 @@ static int compat_sock_ioctl_trans(struc + case SIOCSARP: + case SIOCGARP: + case SIOCDARP: ++ case SIOCOUTQNSD: + case SIOCATMARK: + return sock_do_ioctl(net, sock, cmd, arg); + } diff --git a/queue-5.4/f2fs-fix-potential-overflow.patch b/queue-5.4/f2fs-fix-potential-overflow.patch new file mode 100644 index 00000000000..f4c35d5727a --- /dev/null +++ b/queue-5.4/f2fs-fix-potential-overflow.patch @@ -0,0 +1,48 @@ +From 1f0d5c911b64165c9754139a26c8c2fad352c132 Mon Sep 17 00:00:00 2001 +From: Chao Yu +Date: Thu, 7 Nov 2019 17:29:00 +0800 +Subject: f2fs: fix potential overflow + +From: Chao Yu + +commit 1f0d5c911b64165c9754139a26c8c2fad352c132 upstream. + +We expect 64-bit calculation result from below statement, however +in 32-bit machine, looped left shift operation on pgoff_t type +variable may cause overflow issue, fix it by forcing type cast. + +page->index << PAGE_SHIFT; + +Fixes: 26de9b117130 ("f2fs: avoid unnecessary updating inode during fsync") +Fixes: 0a2aa8fbb969 ("f2fs: refactor __exchange_data_block for speed up") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Greg Kroah-Hartman + +--- + fs/f2fs/data.c | 2 +- + fs/f2fs/file.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -2098,7 +2098,7 @@ static int __write_data_page(struct page + loff_t i_size = i_size_read(inode); + const pgoff_t end_index = ((unsigned long long) i_size) + >> PAGE_SHIFT; +- loff_t psize = (page->index + 1) << PAGE_SHIFT; ++ loff_t psize = (loff_t)(page->index + 1) << PAGE_SHIFT; + unsigned offset = 0; + bool need_balance_fs = false; + int err = 0; +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1139,7 +1139,7 @@ static int __clone_blkaddrs(struct inode + } + dn.ofs_in_node++; + i++; +- new_size = (dst + i) << PAGE_SHIFT; ++ new_size = (loff_t)(dst + i) << PAGE_SHIFT; + if (dst_inode->i_size < new_size) + f2fs_i_size_write(dst_inode, new_size); + } while (--ilen && (do_replace[i] || blkaddr[i] == NULL_ADDR)); diff --git a/queue-5.4/gfs2-add-compat_ioctl-support.patch b/queue-5.4/gfs2-add-compat_ioctl-support.patch new file mode 100644 index 00000000000..294c3b96fda --- /dev/null +++ b/queue-5.4/gfs2-add-compat_ioctl-support.patch @@ -0,0 +1,98 @@ +From 8d0980704842e8a68df2c3164c1c165e5c7ebc08 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 3 Jun 2019 13:40:01 +0200 +Subject: gfs2: add compat_ioctl support + +From: Arnd Bergmann + +commit 8d0980704842e8a68df2c3164c1c165e5c7ebc08 upstream. + +Out of the four ioctl commands supported on gfs2, only FITRIM +works in compat mode. + +Add a proper handler based on the ext4 implementation. + +Fixes: 6ddc5c3ddf25 ("gfs2: getlabel support") +Reviewed-by: Bob Peterson +Cc: Andreas Gruenbacher +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + fs/gfs2/file.c | 30 ++++++++++++++++++++++++++++++ + 1 file changed, 30 insertions(+) + +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -6,6 +6,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -354,6 +355,31 @@ static long gfs2_ioctl(struct file *filp + return -ENOTTY; + } + ++#ifdef CONFIG_COMPAT ++static long gfs2_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) ++{ ++ switch(cmd) { ++ /* These are just misnamed, they actually get/put from/to user an int */ ++ case FS_IOC32_GETFLAGS: ++ cmd = FS_IOC_GETFLAGS; ++ break; ++ case FS_IOC32_SETFLAGS: ++ cmd = FS_IOC_SETFLAGS; ++ break; ++ /* Keep this list in sync with gfs2_ioctl */ ++ case FITRIM: ++ case FS_IOC_GETFSLABEL: ++ break; ++ default: ++ return -ENOIOCTLCMD; ++ } ++ ++ return gfs2_ioctl(filp, cmd, (unsigned long)compat_ptr(arg)); ++} ++#else ++#define gfs2_compat_ioctl NULL ++#endif ++ + /** + * gfs2_size_hint - Give a hint to the size of a write request + * @filep: The struct file +@@ -1294,6 +1320,7 @@ const struct file_operations gfs2_file_f + .write_iter = gfs2_file_write_iter, + .iopoll = iomap_dio_iopoll, + .unlocked_ioctl = gfs2_ioctl, ++ .compat_ioctl = gfs2_compat_ioctl, + .mmap = gfs2_mmap, + .open = gfs2_open, + .release = gfs2_release, +@@ -1309,6 +1336,7 @@ const struct file_operations gfs2_file_f + const struct file_operations gfs2_dir_fops = { + .iterate_shared = gfs2_readdir, + .unlocked_ioctl = gfs2_ioctl, ++ .compat_ioctl = gfs2_compat_ioctl, + .open = gfs2_open, + .release = gfs2_release, + .fsync = gfs2_fsync, +@@ -1325,6 +1353,7 @@ const struct file_operations gfs2_file_f + .write_iter = gfs2_file_write_iter, + .iopoll = iomap_dio_iopoll, + .unlocked_ioctl = gfs2_ioctl, ++ .compat_ioctl = gfs2_compat_ioctl, + .mmap = gfs2_mmap, + .open = gfs2_open, + .release = gfs2_release, +@@ -1338,6 +1367,7 @@ const struct file_operations gfs2_file_f + const struct file_operations gfs2_dir_fops_nolock = { + .iterate_shared = gfs2_readdir, + .unlocked_ioctl = gfs2_ioctl, ++ .compat_ioctl = gfs2_compat_ioctl, + .open = gfs2_open, + .release = gfs2_release, + .fsync = gfs2_fsync, diff --git a/queue-5.4/iommu-mediatek-add-a-new-tlb_lock-for-tlb_flush.patch b/queue-5.4/iommu-mediatek-add-a-new-tlb_lock-for-tlb_flush.patch new file mode 100644 index 00000000000..0b1ec9517f8 --- /dev/null +++ b/queue-5.4/iommu-mediatek-add-a-new-tlb_lock-for-tlb_flush.patch @@ -0,0 +1,103 @@ +From da3cc91b8db403728cde03c8a95cba268d8cbf1b Mon Sep 17 00:00:00 2001 +From: Yong Wu +Date: Mon, 4 Nov 2019 15:01:03 +0800 +Subject: iommu/mediatek: Add a new tlb_lock for tlb_flush + +From: Yong Wu + +commit da3cc91b8db403728cde03c8a95cba268d8cbf1b upstream. + +The commit 4d689b619445 ("iommu/io-pgtable-arm-v7s: Convert to IOMMU API +TLB sync") help move the tlb_sync of unmap from v7s into the iommu +framework. It helps add a new function "mtk_iommu_iotlb_sync", But it +lacked the lock, then it will cause the variable "tlb_flush_active" +may be changed unexpectedly, we could see this warning log randomly: + +mtk-iommu 10205000.iommu: Partial TLB flush timed out, falling back to +full flush + +The HW requires tlb_flush/tlb_sync in pairs strictly, this patch adds +a new tlb_lock for tlb operations to fix this issue. + +Fixes: 4d689b619445 ("iommu/io-pgtable-arm-v7s: Convert to IOMMU API TLB sync") +Signed-off-by: Yong Wu +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/mtk_iommu.c | 23 ++++++++++++++++++++++- + drivers/iommu/mtk_iommu.h | 1 + + 2 files changed, 23 insertions(+), 1 deletion(-) + +--- a/drivers/iommu/mtk_iommu.c ++++ b/drivers/iommu/mtk_iommu.c +@@ -219,22 +219,37 @@ static void mtk_iommu_tlb_sync(void *coo + static void mtk_iommu_tlb_flush_walk(unsigned long iova, size_t size, + size_t granule, void *cookie) + { ++ struct mtk_iommu_data *data = cookie; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&data->tlb_lock, flags); + mtk_iommu_tlb_add_flush_nosync(iova, size, granule, false, cookie); + mtk_iommu_tlb_sync(cookie); ++ spin_unlock_irqrestore(&data->tlb_lock, flags); + } + + static void mtk_iommu_tlb_flush_leaf(unsigned long iova, size_t size, + size_t granule, void *cookie) + { ++ struct mtk_iommu_data *data = cookie; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&data->tlb_lock, flags); + mtk_iommu_tlb_add_flush_nosync(iova, size, granule, true, cookie); + mtk_iommu_tlb_sync(cookie); ++ spin_unlock_irqrestore(&data->tlb_lock, flags); + } + + static void mtk_iommu_tlb_flush_page_nosync(struct iommu_iotlb_gather *gather, + unsigned long iova, size_t granule, + void *cookie) + { ++ struct mtk_iommu_data *data = cookie; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&data->tlb_lock, flags); + mtk_iommu_tlb_add_flush_nosync(iova, granule, granule, true, cookie); ++ spin_unlock_irqrestore(&data->tlb_lock, flags); + } + + static const struct iommu_flush_ops mtk_iommu_flush_ops = { +@@ -453,7 +468,12 @@ static void mtk_iommu_flush_iotlb_all(st + static void mtk_iommu_iotlb_sync(struct iommu_domain *domain, + struct iommu_iotlb_gather *gather) + { +- mtk_iommu_tlb_sync(mtk_iommu_get_m4u_data()); ++ struct mtk_iommu_data *data = mtk_iommu_get_m4u_data(); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&data->tlb_lock, flags); ++ mtk_iommu_tlb_sync(data); ++ spin_unlock_irqrestore(&data->tlb_lock, flags); + } + + static phys_addr_t mtk_iommu_iova_to_phys(struct iommu_domain *domain, +@@ -733,6 +753,7 @@ static int mtk_iommu_probe(struct platfo + if (ret) + return ret; + ++ spin_lock_init(&data->tlb_lock); + list_add_tail(&data->list, &m4ulist); + + if (!iommu_present(&platform_bus_type)) +--- a/drivers/iommu/mtk_iommu.h ++++ b/drivers/iommu/mtk_iommu.h +@@ -58,6 +58,7 @@ struct mtk_iommu_data { + struct iommu_group *m4u_group; + bool enable_4GB; + bool tlb_flush_active; ++ spinlock_t tlb_lock; /* lock for tlb range flush */ + + struct iommu_device iommu; + const struct mtk_iommu_plat_data *plat_data; diff --git a/queue-5.4/iommu-mediatek-correct-the-flush_iotlb_all-callback.patch b/queue-5.4/iommu-mediatek-correct-the-flush_iotlb_all-callback.patch new file mode 100644 index 00000000000..b6e61346c3e --- /dev/null +++ b/queue-5.4/iommu-mediatek-correct-the-flush_iotlb_all-callback.patch @@ -0,0 +1,32 @@ +From 2009122f1d83dd8375572661961eab1e7e86bffe Mon Sep 17 00:00:00 2001 +From: Yong Wu +Date: Mon, 4 Nov 2019 15:01:02 +0800 +Subject: iommu/mediatek: Correct the flush_iotlb_all callback + +From: Yong Wu + +commit 2009122f1d83dd8375572661961eab1e7e86bffe upstream. + +Use the correct tlb_flush_all instead of the original one. + +Fixes: 4d689b619445 ("iommu/io-pgtable-arm-v7s: Convert to IOMMU API TLB sync") +Signed-off-by: Yong Wu +Reviewed-by: Robin Murphy +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iommu/mtk_iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iommu/mtk_iommu.c ++++ b/drivers/iommu/mtk_iommu.c +@@ -447,7 +447,7 @@ static size_t mtk_iommu_unmap(struct iom + + static void mtk_iommu_flush_iotlb_all(struct iommu_domain *domain) + { +- mtk_iommu_tlb_sync(mtk_iommu_get_m4u_data()); ++ mtk_iommu_tlb_flush_all(mtk_iommu_get_m4u_data()); + } + + static void mtk_iommu_iotlb_sync(struct iommu_domain *domain, diff --git a/queue-5.4/iwlwifi-mvm-consider-ieee80211-station-max-amsdu-value.patch b/queue-5.4/iwlwifi-mvm-consider-ieee80211-station-max-amsdu-value.patch new file mode 100644 index 00000000000..2c1e5c7e123 --- /dev/null +++ b/queue-5.4/iwlwifi-mvm-consider-ieee80211-station-max-amsdu-value.patch @@ -0,0 +1,55 @@ +From ee4cce9b9d6421d037ffc002536b918fd7f4aff3 Mon Sep 17 00:00:00 2001 +From: Mordechay Goodstein +Date: Sun, 28 Jul 2019 20:09:22 +0300 +Subject: iwlwifi: mvm: consider ieee80211 station max amsdu value + +From: Mordechay Goodstein + +commit ee4cce9b9d6421d037ffc002536b918fd7f4aff3 upstream. + +debugfs amsdu_len sets only the max_amsdu_len for ieee80211 station +so take it into consideration while getting max amsdu + +Fixes: af2984e9e625 ("iwlwifi: mvm: add a debugfs entry to set a fixed size AMSDU for all TX packets") +Signed-off-by: Mordechay Goodstein +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 8 +++++++- + drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 7 ++++++- + 2 files changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c +@@ -350,7 +350,13 @@ void iwl_mvm_tlc_update_notif(struct iwl + u16 size = le32_to_cpu(notif->amsdu_size); + int i; + +- if (WARN_ON(sta->max_amsdu_len < size)) ++ /* ++ * In debug sta->max_amsdu_len < size ++ * so also check with orig_amsdu_len which holds the original ++ * data before debugfs changed the value ++ */ ++ if (WARN_ON(sta->max_amsdu_len < size && ++ mvmsta->orig_amsdu_len < size)) + goto out; + + mvmsta->amsdu_enabled = le32_to_cpu(notif->amsdu_enabled); +--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +@@ -935,7 +935,12 @@ static int iwl_mvm_tx_tso(struct iwl_mvm + !(mvmsta->amsdu_enabled & BIT(tid))) + return iwl_mvm_tx_tso_segment(skb, 1, netdev_flags, mpdus_skb); + +- max_amsdu_len = iwl_mvm_max_amsdu_size(mvm, sta, tid); ++ /* ++ * Take the min of ieee80211 station and mvm station ++ */ ++ max_amsdu_len = ++ min_t(unsigned int, sta->max_amsdu_len, ++ iwl_mvm_max_amsdu_size(mvm, sta, tid)); + + /* + * Limit A-MSDU in A-MPDU to 4095 bytes when VHT is not diff --git a/queue-5.4/iwlwifi-mvm-fix-support-for-single-antenna-diversity.patch b/queue-5.4/iwlwifi-mvm-fix-support-for-single-antenna-diversity.patch new file mode 100644 index 00000000000..4f998a81e49 --- /dev/null +++ b/queue-5.4/iwlwifi-mvm-fix-support-for-single-antenna-diversity.patch @@ -0,0 +1,61 @@ +From bb99ff9baa02beb9216c86678999342197c849cc Mon Sep 17 00:00:00 2001 +From: Luca Coelho +Date: Fri, 15 Nov 2019 09:27:25 +0200 +Subject: iwlwifi: mvm: fix support for single antenna diversity + +From: Luca Coelho + +commit bb99ff9baa02beb9216c86678999342197c849cc upstream. + +When the single antenna diversity support was sent upstream, only some +definitions were sent, due to a bad revert. + +Fix this by adding the actual code. + +Fixes: 5952e0ec3f05 ("iwlwifi: mvm: add support for single antenna diversity") +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -514,6 +514,18 @@ static int iwl_send_phy_cfg_cmd(struct i + struct iwl_phy_cfg_cmd phy_cfg_cmd; + enum iwl_ucode_type ucode_type = mvm->fwrt.cur_fw_img; + ++ if (iwl_mvm_has_unified_ucode(mvm) && ++ !mvm->trans->cfg->tx_with_siso_diversity) { ++ return 0; ++ } else if (mvm->trans->cfg->tx_with_siso_diversity) { ++ /* ++ * TODO: currently we don't set the antenna but letting the NIC ++ * to decide which antenna to use. This should come from BIOS. ++ */ ++ phy_cfg_cmd.phy_cfg = ++ cpu_to_le32(FW_PHY_CFG_CHAIN_SAD_ENABLED); ++ } ++ + /* Set parameters */ + phy_cfg_cmd.phy_cfg = cpu_to_le32(iwl_mvm_get_phy_config(mvm)); + +@@ -1344,12 +1356,12 @@ int iwl_mvm_up(struct iwl_mvm *mvm) + ret = iwl_send_phy_db_data(mvm->phy_db); + if (ret) + goto error; +- +- ret = iwl_send_phy_cfg_cmd(mvm); +- if (ret) +- goto error; + } + ++ ret = iwl_send_phy_cfg_cmd(mvm); ++ if (ret) ++ goto error; ++ + ret = iwl_mvm_send_bt_init_conf(mvm); + if (ret) + goto error; diff --git a/queue-5.4/media-aspeed-video-fix-memory-leaks-in-aspeed_video_probe.patch b/queue-5.4/media-aspeed-video-fix-memory-leaks-in-aspeed_video_probe.patch new file mode 100644 index 00000000000..6fc4b05fafc --- /dev/null +++ b/queue-5.4/media-aspeed-video-fix-memory-leaks-in-aspeed_video_probe.patch @@ -0,0 +1,38 @@ +From c3df30a01da4955e04fa068c503cd784b31dad92 Mon Sep 17 00:00:00 2001 +From: Navid Emamdoost +Date: Sun, 10 Nov 2019 07:23:38 +0100 +Subject: media: aspeed-video: Fix memory leaks in aspeed_video_probe + +From: Navid Emamdoost + +commit c3df30a01da4955e04fa068c503cd784b31dad92 upstream. + +In the implementation of aspeed_video_probe() the allocated memory for +video should be released if either devm_ioremap_resource() +or aspeed_video_init() or aspeed_video_setup_video() fails. Replace +kzalloc() with devm_kzalloc to avoid explicit release for video. + +Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver") +Signed-off-by: Navid Emamdoost +Reviewed-by: Jae Hyun Yoo +Reviewed-by: Eddie James +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/aspeed-video.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/media/platform/aspeed-video.c ++++ b/drivers/media/platform/aspeed-video.c +@@ -1658,7 +1658,8 @@ static int aspeed_video_probe(struct pla + { + int rc; + struct resource *res; +- struct aspeed_video *video = kzalloc(sizeof(*video), GFP_KERNEL); ++ struct aspeed_video *video = ++ devm_kzalloc(&pdev->dev, sizeof(*video), GFP_KERNEL); + + if (!video) + return -ENOMEM; diff --git a/queue-5.4/media-cedrus-use-correct-h264-8x8-scaling-list.patch b/queue-5.4/media-cedrus-use-correct-h264-8x8-scaling-list.patch new file mode 100644 index 00000000000..7be9191958c --- /dev/null +++ b/queue-5.4/media-cedrus-use-correct-h264-8x8-scaling-list.patch @@ -0,0 +1,36 @@ +From a6b8feae7c88343212686120740cf7551dd16e08 Mon Sep 17 00:00:00 2001 +From: Jonas Karlman +Date: Tue, 29 Oct 2019 01:00:52 +0100 +Subject: media: cedrus: Use correct H264 8x8 scaling list + +From: Jonas Karlman + +commit a6b8feae7c88343212686120740cf7551dd16e08 upstream. + +Documentation now defines the expected order of scaling lists, +change to use correct indices. + +Fixes: 6eb9b758e307 ("media: cedrus: Add H264 decoding support") +Signed-off-by: Jonas Karlman +Reviewed-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c +@@ -244,8 +244,8 @@ static void cedrus_write_scaling_lists(s + sizeof(scaling->scaling_list_8x8[0])); + + cedrus_h264_write_sram(dev, CEDRUS_SRAM_H264_SCALING_LIST_8x8_1, +- scaling->scaling_list_8x8[3], +- sizeof(scaling->scaling_list_8x8[3])); ++ scaling->scaling_list_8x8[1], ++ sizeof(scaling->scaling_list_8x8[1])); + + cedrus_h264_write_sram(dev, CEDRUS_SRAM_H264_SCALING_LIST_4x4, + scaling->scaling_list_4x4, diff --git a/queue-5.4/media-coda-fix-deadlock-between-decoder-picture-run-and-start-command.patch b/queue-5.4/media-coda-fix-deadlock-between-decoder-picture-run-and-start-command.patch new file mode 100644 index 00000000000..7926bbb5a2c --- /dev/null +++ b/queue-5.4/media-coda-fix-deadlock-between-decoder-picture-run-and-start-command.patch @@ -0,0 +1,46 @@ +From a3fd80198de6ab98a205cf7fb148d88e9e1c44bb Mon Sep 17 00:00:00 2001 +From: Philipp Zabel +Date: Thu, 24 Oct 2019 07:32:11 -0300 +Subject: media: coda: fix deadlock between decoder picture run and start command + +From: Philipp Zabel + +commit a3fd80198de6ab98a205cf7fb148d88e9e1c44bb upstream. + +The BIT decoder picture run temporarily locks the bitstream mutex while +the coda device mutex is locked, to refill the bitstream ring buffer. +Consequently, the decoder start command, which locks both mutexes when +flushing the bitstream ring buffer, must lock the coda device mutex +first as well, to avoid an ABBA deadlock. + +Fixes: e7fd95849b3c ("media: coda: flush bitstream ring buffer on decoder restart") +Signed-off-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/coda/coda-common.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -1084,16 +1084,16 @@ static int coda_decoder_cmd(struct file + + switch (dc->cmd) { + case V4L2_DEC_CMD_START: +- mutex_lock(&ctx->bitstream_mutex); + mutex_lock(&dev->coda_mutex); ++ mutex_lock(&ctx->bitstream_mutex); + coda_bitstream_flush(ctx); +- mutex_unlock(&dev->coda_mutex); + dst_vq = v4l2_m2m_get_vq(ctx->fh.m2m_ctx, + V4L2_BUF_TYPE_VIDEO_CAPTURE); + vb2_clear_last_buffer_dequeued(dst_vq); + ctx->bit_stream_param &= ~CODA_BIT_STREAM_END_FLAG; + coda_fill_bitstream(ctx, NULL); + mutex_unlock(&ctx->bitstream_mutex); ++ mutex_unlock(&dev->coda_mutex); + break; + case V4L2_DEC_CMD_STOP: + stream_end = false; diff --git a/queue-5.4/media-exynos4-is-fix-recursive-locking-in-isp_video_release.patch b/queue-5.4/media-exynos4-is-fix-recursive-locking-in-isp_video_release.patch new file mode 100644 index 00000000000..4efcf808d99 --- /dev/null +++ b/queue-5.4/media-exynos4-is-fix-recursive-locking-in-isp_video_release.patch @@ -0,0 +1,36 @@ +From 704c6c80fb471d1bb0ef0d61a94617d1d55743cd Mon Sep 17 00:00:00 2001 +From: Seung-Woo Kim +Date: Fri, 18 Oct 2019 07:20:52 -0300 +Subject: media: exynos4-is: Fix recursive locking in isp_video_release() + +From: Seung-Woo Kim + +commit 704c6c80fb471d1bb0ef0d61a94617d1d55743cd upstream. + +>From isp_video_release(), &isp->video_lock is held and subsequent +vb2_fop_release() tries to lock vdev->lock which is same with the +previous one. Replace vb2_fop_release() with _vb2_fop_release() to +fix the recursive locking. + +Fixes: 1380f5754cb0 ("[media] videobuf2: Add missing lock held on vb2_fop_release") +Signed-off-by: Seung-Woo Kim +Reviewed-by: Sylwester Nawrocki +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/exynos4-is/fimc-isp-video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/exynos4-is/fimc-isp-video.c ++++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c +@@ -313,7 +313,7 @@ static int isp_video_release(struct file + ivc->streaming = 0; + } + +- vb2_fop_release(file); ++ _vb2_fop_release(file, NULL); + + if (v4l2_fh_is_singular_file(file)) { + fimc_pipeline_call(&ivc->ve, close); diff --git a/queue-5.4/media-hantro-do-not-reorder-h264-scaling-list.patch b/queue-5.4/media-hantro-do-not-reorder-h264-scaling-list.patch new file mode 100644 index 00000000000..6332b0beddc --- /dev/null +++ b/queue-5.4/media-hantro-do-not-reorder-h264-scaling-list.patch @@ -0,0 +1,109 @@ +From e17f08e3166635d2eaa6a894afeb28ca651ddd35 Mon Sep 17 00:00:00 2001 +From: Jonas Karlman +Date: Tue, 29 Oct 2019 01:00:53 +0100 +Subject: media: hantro: Do not reorder H264 scaling list + +From: Jonas Karlman + +commit e17f08e3166635d2eaa6a894afeb28ca651ddd35 upstream. + +Scaling list supplied from userspace should be in matrix order +and can be used without applying the inverse scanning process. + +The HW also only support 8x8 scaling list for the Y component, indices 0 +and 1 in the scaling list supplied from userspace. + +Remove reordering and write the scaling matrix in an order expected by +the VPU, also only allocate memory for the two 8x8 lists supported. + +Fixes: a9471e25629b ("media: hantro: Add core bits to support H264 decoding") +Signed-off-by: Jonas Karlman +Reviewed-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/hantro/hantro_h264.c | 51 ++++++----------------------- + 1 file changed, 12 insertions(+), 39 deletions(-) + +--- a/drivers/staging/media/hantro/hantro_h264.c ++++ b/drivers/staging/media/hantro/hantro_h264.c +@@ -20,7 +20,7 @@ + /* Size with u32 units. */ + #define CABAC_INIT_BUFFER_SIZE (460 * 2) + #define POC_BUFFER_SIZE 34 +-#define SCALING_LIST_SIZE (6 * 16 + 6 * 64) ++#define SCALING_LIST_SIZE (6 * 16 + 2 * 64) + + #define POC_CMP(p0, p1) ((p0) < (p1) ? -1 : 1) + +@@ -194,23 +194,6 @@ static const u32 h264_cabac_table[] = { + 0x1f0c2517, 0x1f261440 + }; + +-/* +- * NOTE: The scaling lists are in zig-zag order, apply inverse scanning process +- * to get the values in matrix order. In addition, the hardware requires bytes +- * swapped within each subsequent 4 bytes. Both arrays below include both +- * transformations. +- */ +-static const u32 zig_zag_4x4[] = { +- 3, 2, 7, 11, 6, 1, 0, 5, 10, 15, 14, 9, 4, 8, 13, 12 +-}; +- +-static const u32 zig_zag_8x8[] = { +- 3, 2, 11, 19, 10, 1, 0, 9, 18, 27, 35, 26, 17, 8, 7, 6, +- 15, 16, 25, 34, 43, 51, 42, 33, 24, 23, 14, 5, 4, 13, 22, 31, +- 32, 41, 50, 59, 58, 49, 40, 39, 30, 21, 12, 20, 29, 38, 47, 48, +- 57, 56, 55, 46, 37, 28, 36, 45, 54, 63, 62, 53, 44, 52, 61, 60 +-}; +- + static void + reorder_scaling_list(struct hantro_ctx *ctx) + { +@@ -218,33 +201,23 @@ reorder_scaling_list(struct hantro_ctx * + const struct v4l2_ctrl_h264_scaling_matrix *scaling = ctrls->scaling; + const size_t num_list_4x4 = ARRAY_SIZE(scaling->scaling_list_4x4); + const size_t list_len_4x4 = ARRAY_SIZE(scaling->scaling_list_4x4[0]); +- const size_t num_list_8x8 = ARRAY_SIZE(scaling->scaling_list_8x8); + const size_t list_len_8x8 = ARRAY_SIZE(scaling->scaling_list_8x8[0]); + struct hantro_h264_dec_priv_tbl *tbl = ctx->h264_dec.priv.cpu; +- u8 *dst = tbl->scaling_list; +- const u8 *src; ++ u32 *dst = (u32 *)tbl->scaling_list; ++ const u32 *src; + int i, j; + +- BUILD_BUG_ON(ARRAY_SIZE(zig_zag_4x4) != list_len_4x4); +- BUILD_BUG_ON(ARRAY_SIZE(zig_zag_8x8) != list_len_8x8); +- BUILD_BUG_ON(ARRAY_SIZE(tbl->scaling_list) != +- num_list_4x4 * list_len_4x4 + +- num_list_8x8 * list_len_8x8); +- +- src = &scaling->scaling_list_4x4[0][0]; +- for (i = 0; i < num_list_4x4; ++i) { +- for (j = 0; j < list_len_4x4; ++j) +- dst[zig_zag_4x4[j]] = src[j]; +- src += list_len_4x4; +- dst += list_len_4x4; ++ for (i = 0; i < num_list_4x4; i++) { ++ src = (u32 *)&scaling->scaling_list_4x4[i]; ++ for (j = 0; j < list_len_4x4 / 4; j++) ++ *dst++ = swab32(src[j]); + } + +- src = &scaling->scaling_list_8x8[0][0]; +- for (i = 0; i < num_list_8x8; ++i) { +- for (j = 0; j < list_len_8x8; ++j) +- dst[zig_zag_8x8[j]] = src[j]; +- src += list_len_8x8; +- dst += list_len_8x8; ++ /* Only Intra/Inter Y lists */ ++ for (i = 0; i < 2; i++) { ++ src = (u32 *)&scaling->scaling_list_8x8[i]; ++ for (j = 0; j < list_len_8x8 / 4; j++) ++ *dst++ = swab32(src[j]); + } + } + diff --git a/queue-5.4/media-hantro-h264-fix-the-frame_num-wraparound-case.patch b/queue-5.4/media-hantro-h264-fix-the-frame_num-wraparound-case.patch new file mode 100644 index 00000000000..8a7595a638c --- /dev/null +++ b/queue-5.4/media-hantro-h264-fix-the-frame_num-wraparound-case.patch @@ -0,0 +1,87 @@ +From 9db5f87f6723678a7e7e5e3165439c5c4378edbb Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Mon, 9 Sep 2019 04:28:15 -0300 +Subject: media: hantro: h264: Fix the frame_num wraparound case + +From: Boris Brezillon + +commit 9db5f87f6723678a7e7e5e3165439c5c4378edbb upstream. + +Step '8.2.4.1 Decoding process for picture numbers' was missing in the +reflist creation logic, leading to invalid P reflists when a +->frame_num wraparound happens. + +Fixes: a9471e25629b ("media: hantro: Add core bits to support H264 decoding") +Reported-by: Francois Buergisser +Signed-off-by: Boris Brezillon +Reviewed-by: Philipp Zabel +Tested-by: Philipp Zabel +Tested-by: Francois Buergisser +Reviewed-by: Tomasz Figa +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/hantro/hantro_h264.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +--- a/drivers/staging/media/hantro/hantro_h264.c ++++ b/drivers/staging/media/hantro/hantro_h264.c +@@ -271,6 +271,7 @@ struct hantro_h264_reflist_builder { + const struct v4l2_h264_dpb_entry *dpb; + s32 pocs[HANTRO_H264_DPB_SIZE]; + u8 unordered_reflist[HANTRO_H264_DPB_SIZE]; ++ int frame_nums[HANTRO_H264_DPB_SIZE]; + s32 curpoc; + u8 num_valid; + }; +@@ -294,13 +295,20 @@ static void + init_reflist_builder(struct hantro_ctx *ctx, + struct hantro_h264_reflist_builder *b) + { ++ const struct v4l2_ctrl_h264_slice_params *slice_params; + const struct v4l2_ctrl_h264_decode_params *dec_param; ++ const struct v4l2_ctrl_h264_sps *sps; + struct vb2_v4l2_buffer *buf = hantro_get_dst_buf(ctx); + const struct v4l2_h264_dpb_entry *dpb = ctx->h264_dec.dpb; + struct vb2_queue *cap_q = &ctx->fh.m2m_ctx->cap_q_ctx.q; ++ int cur_frame_num, max_frame_num; + unsigned int i; + + dec_param = ctx->h264_dec.ctrls.decode; ++ slice_params = &ctx->h264_dec.ctrls.slices[0]; ++ sps = ctx->h264_dec.ctrls.sps; ++ max_frame_num = 1 << (sps->log2_max_frame_num_minus4 + 4); ++ cur_frame_num = slice_params->frame_num; + + memset(b, 0, sizeof(*b)); + b->dpb = dpb; +@@ -318,6 +326,18 @@ init_reflist_builder(struct hantro_ctx * + continue; + + buf = to_vb2_v4l2_buffer(vb2_get_buffer(cap_q, buf_idx)); ++ ++ /* ++ * Handle frame_num wraparound as described in section ++ * '8.2.4.1 Decoding process for picture numbers' of the spec. ++ * TODO: This logic will have to be adjusted when we start ++ * supporting interlaced content. ++ */ ++ if (dpb[i].frame_num > cur_frame_num) ++ b->frame_nums[i] = (int)dpb[i].frame_num - max_frame_num; ++ else ++ b->frame_nums[i] = dpb[i].frame_num; ++ + b->pocs[i] = get_poc(buf->field, dpb[i].top_field_order_cnt, + dpb[i].bottom_field_order_cnt); + b->unordered_reflist[b->num_valid] = i; +@@ -353,7 +373,7 @@ static int p_ref_list_cmp(const void *pt + * ascending order. + */ + if (!(a->flags & V4L2_H264_DPB_ENTRY_FLAG_LONG_TERM)) +- return b->frame_num - a->frame_num; ++ return builder->frame_nums[idxb] - builder->frame_nums[idxa]; + + return a->pic_num - b->pic_num; + } diff --git a/queue-5.4/media-hantro-set-h264-fieldpic_flag_e-flag-correctly.patch b/queue-5.4/media-hantro-set-h264-fieldpic_flag_e-flag-correctly.patch new file mode 100644 index 00000000000..9ac1affcd17 --- /dev/null +++ b/queue-5.4/media-hantro-set-h264-fieldpic_flag_e-flag-correctly.patch @@ -0,0 +1,37 @@ +From a2cbf80a842add9663522bf898cf13cb2ac4e423 Mon Sep 17 00:00:00 2001 +From: Jonas Karlman +Date: Wed, 6 Nov 2019 23:35:11 +0100 +Subject: media: hantro: Set H264 FIELDPIC_FLAG_E flag correctly + +From: Jonas Karlman + +commit a2cbf80a842add9663522bf898cf13cb2ac4e423 upstream. + +The FIELDPIC_FLAG_E bit should be set when field_pic_flag exists in stream, +it is currently set based on field_pic_flag of current frame. +The PIC_FIELDMODE_E bit is correctly set based on the field_pic_flag. + +Fix this by setting the FIELDPIC_FLAG_E bit when frame_mbs_only is not set. + +Fixes: dea0a82f3d22 ("media: hantro: Add support for H264 decoding on G1") +Signed-off-by: Jonas Karlman +Reviewed-by: Boris Brezillon +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/hantro/hantro_g1_h264_dec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/staging/media/hantro/hantro_g1_h264_dec.c ++++ b/drivers/staging/media/hantro/hantro_g1_h264_dec.c +@@ -63,7 +63,7 @@ static void set_params(struct hantro_ctx + /* always use the matrix sent from userspace */ + reg |= G1_REG_DEC_CTRL2_TYPE1_QUANT_E; + +- if (slices[0].flags & V4L2_H264_SLICE_FLAG_FIELD_PIC) ++ if (!(sps->flags & V4L2_H264_SPS_FLAG_FRAME_MBS_ONLY)) + reg |= G1_REG_DEC_CTRL2_FIELDPIC_FLAG_E; + vdpu_write_relaxed(vpu, reg, G1_REG_DEC_CTRL2); + diff --git a/queue-5.4/media-ov6650-fix-.get_fmt-v4l2_subdev_format_try-support.patch b/queue-5.4/media-ov6650-fix-.get_fmt-v4l2_subdev_format_try-support.patch new file mode 100644 index 00000000000..0d4ca150cec --- /dev/null +++ b/queue-5.4/media-ov6650-fix-.get_fmt-v4l2_subdev_format_try-support.patch @@ -0,0 +1,52 @@ +From 39034bb0c26b76a2c3abc54aa28c185f18b40c2f Mon Sep 17 00:00:00 2001 +From: Janusz Krzysztofik +Date: Tue, 3 Sep 2019 17:11:41 -0300 +Subject: media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support + +From: Janusz Krzysztofik + +commit 39034bb0c26b76a2c3abc54aa28c185f18b40c2f upstream. + +Commit da298c6d98d5 ("[media] v4l2: replace video op g_mbus_fmt by pad +op get_fmt") converted a former ov6650_g_fmt() video operation callback +to an ov6650_get_fmt() pad operation callback. However, the converted +function disregards a format->which flag that pad operations should +obey and always returns active frame format settings. + +That can be fixed by always responding to V4L2_SUBDEV_FORMAT_TRY with +-EINVAL, or providing the response from a pad config argument, likely +updated by a former user call to V4L2_SUBDEV_FORMAT_TRY .set_fmt(). +Since implementation of the latter is trivial, go for it. + +Fixes: da298c6d98d5 ("[media] v4l2: replace video op g_mbus_fmt by pad op get_fmt") +Signed-off-by: Janusz Krzysztofik +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/i2c/ov6650.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/media/i2c/ov6650.c ++++ b/drivers/media/i2c/ov6650.c +@@ -528,10 +528,16 @@ static int ov6650_get_fmt(struct v4l2_su + *mf = ov6650_def_fmt; + + /* update media bus format code and frame size */ +- mf->width = priv->rect.width >> priv->half_scale; +- mf->height = priv->rect.height >> priv->half_scale; +- mf->code = priv->code; ++ if (format->which == V4L2_SUBDEV_FORMAT_TRY) { ++ mf->width = cfg->try_fmt.width; ++ mf->height = cfg->try_fmt.height; ++ mf->code = cfg->try_fmt.code; + ++ } else { ++ mf->width = priv->rect.width >> priv->half_scale; ++ mf->height = priv->rect.height >> priv->half_scale; ++ mf->code = priv->code; ++ } + return 0; + } + diff --git a/queue-5.4/media-ov6650-fix-default-format-not-applied-on-device-probe.patch b/queue-5.4/media-ov6650-fix-default-format-not-applied-on-device-probe.patch new file mode 100644 index 00000000000..dd6d60ccdde --- /dev/null +++ b/queue-5.4/media-ov6650-fix-default-format-not-applied-on-device-probe.patch @@ -0,0 +1,49 @@ +From 5439fa9263cb293e41168bc03711ec18c4f11cba Mon Sep 17 00:00:00 2001 +From: Janusz Krzysztofik +Date: Tue, 3 Sep 2019 17:11:42 -0300 +Subject: media: ov6650: Fix default format not applied on device probe + +From: Janusz Krzysztofik + +commit 5439fa9263cb293e41168bc03711ec18c4f11cba upstream. + +It is not clear what pixel format is actually configured in hardware on +reset. MEDIA_BUS_FMT_YUYV8_2X8, assumed on device probe since the +driver was intiially submitted, is for sure not the one. + +Fix it by explicitly applying a known, driver default frame format just +after initial device reset. + +Fixes: 2f6e2404799a ("[media] SoC Camera: add driver for OV6650 sensor") +Signed-off-by: Janusz Krzysztofik +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/i2c/ov6650.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/media/i2c/ov6650.c ++++ b/drivers/media/i2c/ov6650.c +@@ -877,6 +877,11 @@ static int ov6650_video_probe(struct v4l + ret = ov6650_reset(client); + if (!ret) + ret = ov6650_prog_dflt(client); ++ if (!ret) { ++ struct v4l2_mbus_framefmt mf = ov6650_def_fmt; ++ ++ ret = ov6650_s_fmt(sd, &mf); ++ } + if (!ret) + ret = v4l2_ctrl_handler_setup(&priv->hdl); + +@@ -1031,8 +1036,6 @@ static int ov6650_probe(struct i2c_clien + priv->rect.top = DEF_VSTRT << 1; + priv->rect.width = W_CIF; + priv->rect.height = H_CIF; +- priv->half_scale = false; +- priv->code = MEDIA_BUS_FMT_YUYV8_2X8; + + /* Hardware default frame interval */ + priv->tpf.numerator = GET_CLKRC_DIV(DEF_CLKRC); diff --git a/queue-5.4/media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch b/queue-5.4/media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch new file mode 100644 index 00000000000..e858e67beee --- /dev/null +++ b/queue-5.4/media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch @@ -0,0 +1,94 @@ +From 12500731895ef09afc5b66b86b76c0884fb9c7bf Mon Sep 17 00:00:00 2001 +From: Janusz Krzysztofik +Date: Tue, 3 Sep 2019 17:11:39 -0300 +Subject: media: ov6650: Fix incorrect use of JPEG colorspace + +From: Janusz Krzysztofik + +commit 12500731895ef09afc5b66b86b76c0884fb9c7bf upstream. + +Since its initial submission, the driver selects V4L2_COLORSPACE_JPEG +for supported formats other than V4L2_MBUS_FMT_SBGGR8_1X8. According +to v4l2-compliance test program, V4L2_COLORSPACE_JPEG applies +exclusively to V4L2_PIX_FMT_JPEG. Since the sensor does not support +JPEG format, fix it to always select V4L2_COLORSPACE_SRGB. + +Fixes: 2f6e2404799a ("[media] SoC Camera: add driver for OV6650 sensor") +Signed-off-by: Janusz Krzysztofik +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/i2c/ov6650.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +--- a/drivers/media/i2c/ov6650.c ++++ b/drivers/media/i2c/ov6650.c +@@ -201,7 +201,6 @@ struct ov6650 { + unsigned long pclk_max; /* from resolution and format */ + struct v4l2_fract tpf; /* as requested with s_frame_interval */ + u32 code; +- enum v4l2_colorspace colorspace; + }; + + +@@ -517,7 +516,7 @@ static int ov6650_get_fmt(struct v4l2_su + mf->width = priv->rect.width >> priv->half_scale; + mf->height = priv->rect.height >> priv->half_scale; + mf->code = priv->code; +- mf->colorspace = priv->colorspace; ++ mf->colorspace = V4L2_COLORSPACE_SRGB; + mf->field = V4L2_FIELD_NONE; + + return 0; +@@ -624,11 +623,6 @@ static int ov6650_s_fmt(struct v4l2_subd + priv->pclk_max = 8000000; + } + +- if (code == MEDIA_BUS_FMT_SBGGR8_1X8) +- priv->colorspace = V4L2_COLORSPACE_SRGB; +- else if (code != 0) +- priv->colorspace = V4L2_COLORSPACE_JPEG; +- + if (half_scale) { + dev_dbg(&client->dev, "max resolution: QCIF\n"); + coma_set |= COMA_QCIF; +@@ -663,7 +657,6 @@ static int ov6650_s_fmt(struct v4l2_subd + priv->code = code; + + if (!ret) { +- mf->colorspace = priv->colorspace; + mf->width = priv->rect.width >> half_scale; + mf->height = priv->rect.height >> half_scale; + } +@@ -686,6 +679,7 @@ static int ov6650_set_fmt(struct v4l2_su + &mf->height, 2, H_CIF, 1, 0); + + mf->field = V4L2_FIELD_NONE; ++ mf->colorspace = V4L2_COLORSPACE_SRGB; + + switch (mf->code) { + case MEDIA_BUS_FMT_Y10_1X10: +@@ -696,13 +690,11 @@ static int ov6650_set_fmt(struct v4l2_su + case MEDIA_BUS_FMT_YUYV8_2X8: + case MEDIA_BUS_FMT_VYUY8_2X8: + case MEDIA_BUS_FMT_UYVY8_2X8: +- mf->colorspace = V4L2_COLORSPACE_JPEG; + break; + default: + mf->code = MEDIA_BUS_FMT_SBGGR8_1X8; + /* fall through */ + case MEDIA_BUS_FMT_SBGGR8_1X8: +- mf->colorspace = V4L2_COLORSPACE_SRGB; + break; + } + +@@ -1008,7 +1000,6 @@ static int ov6650_probe(struct i2c_clien + priv->rect.height = H_CIF; + priv->half_scale = false; + priv->code = MEDIA_BUS_FMT_YUYV8_2X8; +- priv->colorspace = V4L2_COLORSPACE_JPEG; + + /* Hardware default frame interval */ + priv->tpf.numerator = GET_CLKRC_DIV(DEF_CLKRC); diff --git a/queue-5.4/media-ov6650-fix-some-format-attributes-not-under-control.patch b/queue-5.4/media-ov6650-fix-some-format-attributes-not-under-control.patch new file mode 100644 index 00000000000..805b35a663c --- /dev/null +++ b/queue-5.4/media-ov6650-fix-some-format-attributes-not-under-control.patch @@ -0,0 +1,128 @@ +From 1c6a2b63095154bbf9e8f38d79487a728331bf65 Mon Sep 17 00:00:00 2001 +From: Janusz Krzysztofik +Date: Tue, 3 Sep 2019 17:11:40 -0300 +Subject: media: ov6650: Fix some format attributes not under control + +From: Janusz Krzysztofik + +commit 1c6a2b63095154bbf9e8f38d79487a728331bf65 upstream. + +User arguments passed to .get/set_fmt() pad operation callbacks may +contain unsupported values. The driver takes control over frame size +and pixel code as well as colorspace and field attributes but has never +cared for remainig format attributes, i.e., ycbcr_enc, quantization +and xfer_func, introduced by commit 11ff030c7365 ("[media] +v4l2-mediabus: improve colorspace support"). Fix it. + +Set up a static v4l2_mbus_framefmt structure with attributes +initialized to reasonable defaults and use it for updating content of +user provided arguments. In case of V4L2_SUBDEV_FORMAT_ACTIVE, +postpone frame size update, now performed from inside ov6650_s_fmt() +helper, util the user argument is first updated in ov6650_set_fmt() with +default frame format content. For V4L2_SUBDEV_FORMAT_TRY, don't copy +all attributes to pad config, only those handled by the driver, then +fill the response with the default frame format updated with resulting +pad config format code and frame size. + +Fixes: 11ff030c7365 ("[media] v4l2-mediabus: improve colorspace support") +Signed-off-by: Janusz Krzysztofik +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/i2c/ov6650.c | 51 ++++++++++++++++++++++++++++++++++----------- + 1 file changed, 39 insertions(+), 12 deletions(-) + +--- a/drivers/media/i2c/ov6650.c ++++ b/drivers/media/i2c/ov6650.c +@@ -213,6 +213,17 @@ static u32 ov6650_codes[] = { + MEDIA_BUS_FMT_Y8_1X8, + }; + ++static const struct v4l2_mbus_framefmt ov6650_def_fmt = { ++ .width = W_CIF, ++ .height = H_CIF, ++ .code = MEDIA_BUS_FMT_SBGGR8_1X8, ++ .colorspace = V4L2_COLORSPACE_SRGB, ++ .field = V4L2_FIELD_NONE, ++ .ycbcr_enc = V4L2_YCBCR_ENC_DEFAULT, ++ .quantization = V4L2_QUANTIZATION_DEFAULT, ++ .xfer_func = V4L2_XFER_FUNC_DEFAULT, ++}; ++ + /* read a register */ + static int ov6650_reg_read(struct i2c_client *client, u8 reg, u8 *val) + { +@@ -513,11 +524,13 @@ static int ov6650_get_fmt(struct v4l2_su + if (format->pad) + return -EINVAL; + ++ /* initialize response with default media bus frame format */ ++ *mf = ov6650_def_fmt; ++ ++ /* update media bus format code and frame size */ + mf->width = priv->rect.width >> priv->half_scale; + mf->height = priv->rect.height >> priv->half_scale; + mf->code = priv->code; +- mf->colorspace = V4L2_COLORSPACE_SRGB; +- mf->field = V4L2_FIELD_NONE; + + return 0; + } +@@ -656,10 +669,6 @@ static int ov6650_s_fmt(struct v4l2_subd + if (!ret) + priv->code = code; + +- if (!ret) { +- mf->width = priv->rect.width >> half_scale; +- mf->height = priv->rect.height >> half_scale; +- } + return ret; + } + +@@ -678,9 +687,6 @@ static int ov6650_set_fmt(struct v4l2_su + v4l_bound_align_image(&mf->width, 2, W_CIF, 1, + &mf->height, 2, H_CIF, 1, 0); + +- mf->field = V4L2_FIELD_NONE; +- mf->colorspace = V4L2_COLORSPACE_SRGB; +- + switch (mf->code) { + case MEDIA_BUS_FMT_Y10_1X10: + mf->code = MEDIA_BUS_FMT_Y8_1X8; +@@ -698,10 +704,31 @@ static int ov6650_set_fmt(struct v4l2_su + break; + } + +- if (format->which == V4L2_SUBDEV_FORMAT_ACTIVE) +- return ov6650_s_fmt(sd, mf); +- cfg->try_fmt = *mf; ++ if (format->which == V4L2_SUBDEV_FORMAT_TRY) { ++ /* store media bus format code and frame size in pad config */ ++ cfg->try_fmt.width = mf->width; ++ cfg->try_fmt.height = mf->height; ++ cfg->try_fmt.code = mf->code; ++ ++ /* return default mbus frame format updated with pad config */ ++ *mf = ov6650_def_fmt; ++ mf->width = cfg->try_fmt.width; ++ mf->height = cfg->try_fmt.height; ++ mf->code = cfg->try_fmt.code; ++ ++ } else { ++ /* apply new media bus format code and frame size */ ++ int ret = ov6650_s_fmt(sd, mf); + ++ if (ret) ++ return ret; ++ ++ /* return default format updated with active size and code */ ++ *mf = ov6650_def_fmt; ++ mf->width = priv->rect.width >> priv->half_scale; ++ mf->height = priv->rect.height >> priv->half_scale; ++ mf->code = priv->code; ++ } + return 0; + } + diff --git a/queue-5.4/media-rcar-vin-fix-incorrect-return-statement-in-rvin_try_format.patch b/queue-5.4/media-rcar-vin-fix-incorrect-return-statement-in-rvin_try_format.patch new file mode 100644 index 00000000000..3c9e9190e49 --- /dev/null +++ b/queue-5.4/media-rcar-vin-fix-incorrect-return-statement-in-rvin_try_format.patch @@ -0,0 +1,48 @@ +From a0862a40364e2f87109317e31c51c9d7bc89e33f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Niklas=20S=C3=B6derlund?= + +Date: Wed, 4 Sep 2019 18:54:04 -0300 +Subject: media: rcar-vin: Fix incorrect return statement in rvin_try_format() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Söderlund + +commit a0862a40364e2f87109317e31c51c9d7bc89e33f upstream. + +While refactoring code the return statement became corrupted, fix it by +returning the correct return code. + +Reported-by: Kieran Bingham +Fixes: 897e371389e77514 ("media: rcar-vin: simplify how formats are set and reset" +Signed-off-by: Niklas Söderlund +Reviewed-by: Laurent Pinchart +Reviewed-by: Kieran Bingham +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/rcar-vin/rcar-v4l2.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/media/platform/rcar-vin/rcar-v4l2.c ++++ b/drivers/media/platform/rcar-vin/rcar-v4l2.c +@@ -208,6 +208,7 @@ static int rvin_try_format(struct rvin_d + ret = v4l2_subdev_call(sd, pad, set_fmt, pad_cfg, &format); + if (ret < 0 && ret != -ENOIOCTLCMD) + goto done; ++ ret = 0; + + v4l2_fill_pix_format(pix, &format.format); + +@@ -242,7 +243,7 @@ static int rvin_try_format(struct rvin_d + done: + v4l2_subdev_free_pad_config(pad_cfg); + +- return 0; ++ return ret; + } + + static int rvin_querycap(struct file *file, void *priv, diff --git a/queue-5.4/media-v4l-cadence-fix-how-unsued-lanes-are-handled-in-csi2rx_start.patch b/queue-5.4/media-v4l-cadence-fix-how-unsued-lanes-are-handled-in-csi2rx_start.patch new file mode 100644 index 00000000000..4d1f47fd68b --- /dev/null +++ b/queue-5.4/media-v4l-cadence-fix-how-unsued-lanes-are-handled-in-csi2rx_start.patch @@ -0,0 +1,33 @@ +From 2eca8e4c1df4864b937752c3aa2f7925114f4806 Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Fri, 13 Sep 2019 16:06:47 -0300 +Subject: media: v4l: cadence: Fix how unsued lanes are handled in 'csi2rx_start()' + +From: Christophe JAILLET + +commit 2eca8e4c1df4864b937752c3aa2f7925114f4806 upstream. + +The 2nd parameter of 'find_first_zero_bit()' is a number of bits, not of +bytes. So use 'csi2rx->max_lanes' instead of 'sizeof(lanes_used)'. + +Fixes: 1fc3b37f34f6 ("media: v4l: cadence: Add Cadence MIPI-CSI2 RX driver") +Signed-off-by: Christophe JAILLET +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/cadence/cdns-csi2rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/cadence/cdns-csi2rx.c ++++ b/drivers/media/platform/cadence/cdns-csi2rx.c +@@ -129,7 +129,7 @@ static int csi2rx_start(struct csi2rx_pr + */ + for (i = csi2rx->num_lanes; i < csi2rx->max_lanes; i++) { + unsigned int idx = find_first_zero_bit(&lanes_used, +- sizeof(lanes_used)); ++ csi2rx->max_lanes); + set_bit(idx, &lanes_used); + reg |= CSI2RX_STATIC_CFG_DLANE_MAP(i, i + 1); + } diff --git a/queue-5.4/memory-mtk-smi-add-pm-suspend-and-resume-ops.patch b/queue-5.4/memory-mtk-smi-add-pm-suspend-and-resume-ops.patch new file mode 100644 index 00000000000..dc7c516b9d7 --- /dev/null +++ b/queue-5.4/memory-mtk-smi-add-pm-suspend-and-resume-ops.patch @@ -0,0 +1,50 @@ +From fb03082a54acd66c61535edfefe96b2ff88ce7e2 Mon Sep 17 00:00:00 2001 +From: Yong Wu +Date: Wed, 9 Oct 2019 19:59:33 +0800 +Subject: memory: mtk-smi: Add PM suspend and resume ops + +From: Yong Wu + +commit fb03082a54acd66c61535edfefe96b2ff88ce7e2 upstream. + +In the commit 4f0a1a1ae351 ("memory: mtk-smi: Invoke pm runtime_callback +to enable clocks"), we use pm_runtime callback to enable/disable the smi +larb clocks. It will cause the larb's clock may not be disabled when +suspend. That is because device_prepare will call pm_runtime_get_noresume +which will keep the larb's PM runtime status still is active when suspend, +then it won't enter our pm_runtime suspend callback to disable the +corresponding clocks. + +This patch adds suspend pm_ops to force disable the clocks, Use "LATE" to +make sure it disable the larb's clocks after the multimedia devices. + +Fixes: 4f0a1a1ae351 ("memory: mtk-smi: Invoke pm runtime_callback to enable clocks") +Signed-off-by: Anan Sun +Signed-off-by: Yong Wu +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/memory/mtk-smi.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/memory/mtk-smi.c ++++ b/drivers/memory/mtk-smi.c +@@ -366,6 +366,8 @@ static int __maybe_unused mtk_smi_larb_s + + static const struct dev_pm_ops smi_larb_pm_ops = { + SET_RUNTIME_PM_OPS(mtk_smi_larb_suspend, mtk_smi_larb_resume, NULL) ++ SET_LATE_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, ++ pm_runtime_force_resume) + }; + + static struct platform_driver mtk_smi_larb_driver = { +@@ -507,6 +509,8 @@ static int __maybe_unused mtk_smi_common + + static const struct dev_pm_ops smi_common_pm_ops = { + SET_RUNTIME_PM_OPS(mtk_smi_common_suspend, mtk_smi_common_resume, NULL) ++ SET_LATE_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, ++ pm_runtime_force_resume) + }; + + static struct platform_driver mtk_smi_common_driver = { diff --git a/queue-5.4/mips-loongson-fix-return-value-of-loongson_hwmon_init.patch b/queue-5.4/mips-loongson-fix-return-value-of-loongson_hwmon_init.patch new file mode 100644 index 00000000000..c910b4a7325 --- /dev/null +++ b/queue-5.4/mips-loongson-fix-return-value-of-loongson_hwmon_init.patch @@ -0,0 +1,38 @@ +From dece3c2a320b0a6d891da6ff774ab763969b6860 Mon Sep 17 00:00:00 2001 +From: Tiezhu Yang +Date: Mon, 4 Nov 2019 21:33:50 +0800 +Subject: MIPS: Loongson: Fix return value of loongson_hwmon_init + +From: Tiezhu Yang + +commit dece3c2a320b0a6d891da6ff774ab763969b6860 upstream. + +When call function hwmon_device_register failed, use the actual +return value instead of always -ENOMEM. + +Fixes: 64f09aa967e1 ("MIPS: Loongson-3: Add CPU Hwmon platform driver") +Signed-off-by: Tiezhu Yang +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: James Hogan +Cc: Huacai Chen +Cc: Jiaxun Yang +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/mips/cpu_hwmon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/platform/mips/cpu_hwmon.c ++++ b/drivers/platform/mips/cpu_hwmon.c +@@ -161,7 +161,7 @@ static int __init loongson_hwmon_init(vo + + cpu_hwmon_dev = hwmon_device_register(NULL); + if (IS_ERR(cpu_hwmon_dev)) { +- ret = -ENOMEM; ++ ret = PTR_ERR(cpu_hwmon_dev); + pr_err("hwmon_device_register fail!\n"); + goto fail_hwmon_device_register; + } diff --git a/queue-5.4/mips-pci-remember-nasid-changed-by-set-interrupt-affinity.patch b/queue-5.4/mips-pci-remember-nasid-changed-by-set-interrupt-affinity.patch new file mode 100644 index 00000000000..bae620e6cb9 --- /dev/null +++ b/queue-5.4/mips-pci-remember-nasid-changed-by-set-interrupt-affinity.patch @@ -0,0 +1,47 @@ +From 37640adbefd66491cb8083a438f7bf366ac09bc7 Mon Sep 17 00:00:00 2001 +From: Thomas Bogendoerfer +Date: Tue, 19 Nov 2019 12:08:57 +0100 +Subject: MIPS: PCI: remember nasid changed by set interrupt affinity + +From: Thomas Bogendoerfer + +commit 37640adbefd66491cb8083a438f7bf366ac09bc7 upstream. + +When changing interrupt affinity remember the possible changed nasid, +otherwise an interrupt deactivate/activate sequence will incorrectly +setup interrupt. + +Fixes: e6308b6d35ea ("MIPS: SGI-IP27: abstract chipset irq from bridge") +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/pci/pci-xtalk-bridge.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/arch/mips/pci/pci-xtalk-bridge.c ++++ b/arch/mips/pci/pci-xtalk-bridge.c +@@ -279,16 +279,15 @@ static int bridge_set_affinity(struct ir + struct bridge_irq_chip_data *data = d->chip_data; + int bit = d->parent_data->hwirq; + int pin = d->hwirq; +- nasid_t nasid; + int ret, cpu; + + ret = irq_chip_set_affinity_parent(d, mask, force); + if (ret >= 0) { + cpu = cpumask_first_and(mask, cpu_online_mask); +- nasid = COMPACT_TO_NASID_NODEID(cpu_to_node(cpu)); ++ data->nnasid = COMPACT_TO_NASID_NODEID(cpu_to_node(cpu)); + bridge_write(data->bc, b_int_addr[pin].addr, + (((data->bc->intr_addr >> 30) & 0x30000) | +- bit | (nasid << 8))); ++ bit | (data->nasid << 8))); + bridge_read(data->bc, b_wid_tflush); + } + return ret; diff --git a/queue-5.4/mips-sgi-ip27-fix-crash-when-cpus-are-disabled-via-nr_cpus-parameter.patch b/queue-5.4/mips-sgi-ip27-fix-crash-when-cpus-are-disabled-via-nr_cpus-parameter.patch new file mode 100644 index 00000000000..d9412af1a7d --- /dev/null +++ b/queue-5.4/mips-sgi-ip27-fix-crash-when-cpus-are-disabled-via-nr_cpus-parameter.patch @@ -0,0 +1,46 @@ +From e3d765a941f6130fd94e47b2064cfee71f4cbadd Mon Sep 17 00:00:00 2001 +From: Thomas Bogendoerfer +Date: Tue, 19 Nov 2019 12:08:56 +0100 +Subject: MIPS: SGI-IP27: Fix crash, when CPUs are disabled via nr_cpus parameter + +From: Thomas Bogendoerfer + +commit e3d765a941f6130fd94e47b2064cfee71f4cbadd upstream. + +If number of CPUs are limited by the kernel commandline parameter nr_cpus +assignment of interrupts accourding to numa rules might not be possibe. +As a fallback use one of the online CPUs as interrupt destination. + +Fixes: 69a07a41d908 ("MIPS: SGI-IP27: rework HUB interrupts") +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/sgi-ip27/ip27-irq.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/mips/sgi-ip27/ip27-irq.c ++++ b/arch/mips/sgi-ip27/ip27-irq.c +@@ -73,6 +73,9 @@ static void setup_hub_mask(struct hub_ir + int cpu; + + cpu = cpumask_first_and(mask, cpu_online_mask); ++ if (cpu >= nr_cpu_ids) ++ cpu = cpumask_any(cpu_online_mask); ++ + nasid = COMPACT_TO_NASID_NODEID(cpu_to_node(cpu)); + hd->cpu = cpu; + if (!cputoslice(cpu)) { +@@ -139,6 +142,7 @@ static int hub_domain_alloc(struct irq_d + /* use CPU connected to nearest hub */ + hub = hub_data(NASID_TO_COMPACT_NODEID(info->nasid)); + setup_hub_mask(hd, &hub->h_cpus); ++ info->nasid = cpu_to_node(hd->cpu); + + /* Make sure it's not already pending when we connect it. */ + REMOTE_HUB_CLR_INTR(info->nasid, swlevel); diff --git a/queue-5.4/mtd-spi-nor-fix-silent-truncation-in-spi_nor_read.patch b/queue-5.4/mtd-spi-nor-fix-silent-truncation-in-spi_nor_read.patch new file mode 100644 index 00000000000..568cd476fe5 --- /dev/null +++ b/queue-5.4/mtd-spi-nor-fix-silent-truncation-in-spi_nor_read.patch @@ -0,0 +1,34 @@ +From a719a75a7761e4139dd099330d9fe3589d844f9b Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov +Date: Wed, 30 Oct 2019 21:48:59 +0300 +Subject: mtd: spi-nor: fix silent truncation in spi_nor_read() + +From: Sergei Shtylyov + +commit a719a75a7761e4139dd099330d9fe3589d844f9b upstream. + +spi_nor_read() assigns the result of 'ssize_t spi_nor_read_data()' +to the 'int ret' variable, while 'ssize_t' is a 64-bit type and *int* +is a 32-bit type on the 64-bit machines. This silent truncation isn't +really valid, so fix up the variable's type. + +Fixes: 59451e1233bd ("mtd: spi-nor: change return value of read/write") +Signed-off-by: Sergei Shtylyov +Signed-off-by: Tudor Ambarus +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/spi-nor/spi-nor.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/spi-nor/spi-nor.c ++++ b/drivers/mtd/spi-nor/spi-nor.c +@@ -2544,7 +2544,7 @@ static int spi_nor_read(struct mtd_info + size_t *retlen, u_char *buf) + { + struct spi_nor *nor = mtd_to_spi_nor(mtd); +- int ret; ++ ssize_t ret; + + dev_dbg(nor->dev, "from 0x%08x, len %zd\n", (u32)from, len); + diff --git a/queue-5.4/mtd-spi-nor-fix-silent-truncation-in-spi_nor_read_raw.patch b/queue-5.4/mtd-spi-nor-fix-silent-truncation-in-spi_nor_read_raw.patch new file mode 100644 index 00000000000..61c659311d3 --- /dev/null +++ b/queue-5.4/mtd-spi-nor-fix-silent-truncation-in-spi_nor_read_raw.patch @@ -0,0 +1,34 @@ +From 3d63ee5deb466fd66ed6ffb164a87ce36425cf36 Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov +Date: Wed, 30 Oct 2019 21:53:03 +0300 +Subject: mtd: spi-nor: fix silent truncation in spi_nor_read_raw() + +From: Sergei Shtylyov + +commit 3d63ee5deb466fd66ed6ffb164a87ce36425cf36 upstream. + +spi_nor_read_raw() assigns the result of 'ssize_t spi_nor_read_data()' +to the 'int ret' variable, while 'ssize_t' is a 64-bit type and *int* +is a 32-bit type on the 64-bit machines. This silent truncation isn't +really valid, so fix up the variable's type. + +Fixes: f384b352cbf0 ("mtd: spi-nor: parse Serial Flash Discoverable Parameters (SFDP) tables") +Signed-off-by: Sergei Shtylyov +Signed-off-by: Tudor Ambarus +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/spi-nor/spi-nor.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/spi-nor/spi-nor.c ++++ b/drivers/mtd/spi-nor/spi-nor.c +@@ -2865,7 +2865,7 @@ static int spi_nor_hwcaps_pp2cmd(u32 hwc + */ + static int spi_nor_read_raw(struct spi_nor *nor, u32 addr, size_t len, u8 *buf) + { +- int ret; ++ ssize_t ret; + + while (len) { + ret = spi_nor_read_data(nor, addr, len, buf); diff --git a/queue-5.4/nfsd-fixing-possible-null-pointer-derefering-in-copy-offload.patch b/queue-5.4/nfsd-fixing-possible-null-pointer-derefering-in-copy-offload.patch new file mode 100644 index 00000000000..cca502037fb --- /dev/null +++ b/queue-5.4/nfsd-fixing-possible-null-pointer-derefering-in-copy-offload.patch @@ -0,0 +1,34 @@ +From 18f428d4e2f7eff162d80b2b21689496c4e82afd Mon Sep 17 00:00:00 2001 +From: Olga Kornievskaia +Date: Wed, 4 Dec 2019 15:13:54 -0500 +Subject: NFSD fixing possible null pointer derefering in copy offload + +From: Olga Kornievskaia + +commit 18f428d4e2f7eff162d80b2b21689496c4e82afd upstream. + +Static checker revealed possible error path leading to possible +NULL pointer dereferencing. + +Reported-by: Dan Carpenter +Fixes: e0639dc5805a: ("NFSD introduce async copy feature") +Signed-off-by: Olga Kornievskaia +Signed-off-by: J. Bruce Fields +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfsd/nfs4proc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1298,7 +1298,8 @@ nfsd4_copy(struct svc_rqst *rqstp, struc + out: + return status; + out_err: +- cleanup_async_copy(async_copy); ++ if (async_copy) ++ cleanup_async_copy(async_copy); + goto out; + } + diff --git a/queue-5.4/pci-aardvark-fix-pci_exp_rtctl-register-configuration.patch b/queue-5.4/pci-aardvark-fix-pci_exp_rtctl-register-configuration.patch new file mode 100644 index 00000000000..8a7c6e365aa --- /dev/null +++ b/queue-5.4/pci-aardvark-fix-pci_exp_rtctl-register-configuration.patch @@ -0,0 +1,54 @@ +From c0f05a6ab52535c1bf5f43272eede3e11c5701a5 Mon Sep 17 00:00:00 2001 +From: Remi Pommarel +Date: Fri, 14 Jun 2019 12:10:59 +0200 +Subject: PCI: aardvark: Fix PCI_EXP_RTCTL register configuration + +From: Remi Pommarel + +commit c0f05a6ab52535c1bf5f43272eede3e11c5701a5 upstream. + +PCI_EXP_RTCTL is used to activate PME interrupt only, so writing into it +should not modify other interrupts' mask. The ISR mask polarity was also +inverted, when PCI_EXP_RTCTL_PMEIE is set PCIE_MSG_PM_PME_MASK mask bit +should actually be cleared. + +Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space") +Signed-off-by: Remi Pommarel +Signed-off-by: Lorenzo Pieralisi +Acked-by: Thomas Petazzoni +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/controller/pci-aardvark.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -428,7 +428,7 @@ advk_pci_bridge_emul_pcie_conf_read(stru + + case PCI_EXP_RTCTL: { + u32 val = advk_readl(pcie, PCIE_ISR0_MASK_REG); +- *value = (val & PCIE_MSG_PM_PME_MASK) ? PCI_EXP_RTCTL_PMEIE : 0; ++ *value = (val & PCIE_MSG_PM_PME_MASK) ? 0 : PCI_EXP_RTCTL_PMEIE; + return PCI_BRIDGE_EMUL_HANDLED; + } + +@@ -478,10 +478,15 @@ advk_pci_bridge_emul_pcie_conf_write(str + advk_pcie_wait_for_retrain(pcie); + break; + +- case PCI_EXP_RTCTL: +- new = (new & PCI_EXP_RTCTL_PMEIE) << 3; +- advk_writel(pcie, new, PCIE_ISR0_MASK_REG); ++ case PCI_EXP_RTCTL: { ++ /* Only mask/unmask PME interrupt */ ++ u32 val = advk_readl(pcie, PCIE_ISR0_MASK_REG) & ++ ~PCIE_MSG_PM_PME_MASK; ++ if ((new & PCI_EXP_RTCTL_PMEIE) == 0) ++ val |= PCIE_MSG_PM_PME_MASK; ++ advk_writel(pcie, val, PCIE_ISR0_MASK_REG); + break; ++ } + + case PCI_EXP_RTSTA: + new = (new & PCI_EXP_RTSTA_PME) >> 9; diff --git a/queue-5.4/pci-aardvark-use-ltssm-state-to-build-link-training-flag.patch b/queue-5.4/pci-aardvark-use-ltssm-state-to-build-link-training-flag.patch new file mode 100644 index 00000000000..5a3797b5ea3 --- /dev/null +++ b/queue-5.4/pci-aardvark-use-ltssm-state-to-build-link-training-flag.patch @@ -0,0 +1,103 @@ +From 364b3f1ff8f096d45f042a9c85daf7a1fc78413e Mon Sep 17 00:00:00 2001 +From: Remi Pommarel +Date: Wed, 22 May 2019 23:33:51 +0200 +Subject: PCI: aardvark: Use LTSSM state to build link training flag + +From: Remi Pommarel + +commit 364b3f1ff8f096d45f042a9c85daf7a1fc78413e upstream. + +Aardvark's PCI_EXP_LNKSTA_LT flag in its link status register is not +implemented and does not reflect the actual link training state (the +flag is always set to 0). In order to support link re-training feature +this flag has to be emulated. The Link Training and Status State +Machine (LTSSM) flag in Aardvark LMI config register could be used as +a link training indicator. Indeed if the LTSSM is in L0 or upper state +then link training has completed (see [1]). + +Unfortunately because after asking a link retraining it takes a while +for the LTSSM state to become less than 0x10 (due to L0s to recovery +state transition delays), LTSSM can still be in L0 while link training +has not finished yet. So this waits for link to be in recovery or lesser +state before returning after asking for a link retrain. + +[1] "PCI Express Base Specification", REV. 4.0 + PCI Express, February 19 2014, Table 4-14 + +Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space") +Tested-by: Marc Zyngier +Signed-off-by: Remi Pommarel +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Andrew Murray +Acked-by: Thomas Petazzoni +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/controller/pci-aardvark.c | 29 ++++++++++++++++++++++++++++- + 1 file changed, 28 insertions(+), 1 deletion(-) + +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -180,6 +180,8 @@ + #define LINK_WAIT_MAX_RETRIES 10 + #define LINK_WAIT_USLEEP_MIN 90000 + #define LINK_WAIT_USLEEP_MAX 100000 ++#define RETRAIN_WAIT_MAX_RETRIES 10 ++#define RETRAIN_WAIT_USLEEP_US 2000 + + #define MSI_IRQ_NUM 32 + +@@ -239,6 +241,17 @@ static int advk_pcie_wait_for_link(struc + return -ETIMEDOUT; + } + ++static void advk_pcie_wait_for_retrain(struct advk_pcie *pcie) ++{ ++ size_t retries; ++ ++ for (retries = 0; retries < RETRAIN_WAIT_MAX_RETRIES; ++retries) { ++ if (!advk_pcie_link_up(pcie)) ++ break; ++ udelay(RETRAIN_WAIT_USLEEP_US); ++ } ++} ++ + static void advk_pcie_setup_hw(struct advk_pcie *pcie) + { + u32 reg; +@@ -426,11 +439,20 @@ advk_pci_bridge_emul_pcie_conf_read(stru + return PCI_BRIDGE_EMUL_HANDLED; + } + ++ case PCI_EXP_LNKCTL: { ++ /* u32 contains both PCI_EXP_LNKCTL and PCI_EXP_LNKSTA */ ++ u32 val = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + reg) & ++ ~(PCI_EXP_LNKSTA_LT << 16); ++ if (!advk_pcie_link_up(pcie)) ++ val |= (PCI_EXP_LNKSTA_LT << 16); ++ *value = val; ++ return PCI_BRIDGE_EMUL_HANDLED; ++ } ++ + case PCI_CAP_LIST_ID: + case PCI_EXP_DEVCAP: + case PCI_EXP_DEVCTL: + case PCI_EXP_LNKCAP: +- case PCI_EXP_LNKCTL: + *value = advk_readl(pcie, PCIE_CORE_PCIEXP_CAP + reg); + return PCI_BRIDGE_EMUL_HANDLED; + default: +@@ -447,8 +469,13 @@ advk_pci_bridge_emul_pcie_conf_write(str + + switch (reg) { + case PCI_EXP_DEVCTL: ++ advk_writel(pcie, new, PCIE_CORE_PCIEXP_CAP + reg); ++ break; ++ + case PCI_EXP_LNKCTL: + advk_writel(pcie, new, PCIE_CORE_PCIEXP_CAP + reg); ++ if (new & PCI_EXP_LNKCTL_RL) ++ advk_pcie_wait_for_retrain(pcie); + break; + + case PCI_EXP_RTCTL: diff --git a/queue-5.4/pci-dwc-fix-find_next_bit-usage.patch b/queue-5.4/pci-dwc-fix-find_next_bit-usage.patch new file mode 100644 index 00000000000..b6be4735e21 --- /dev/null +++ b/queue-5.4/pci-dwc-fix-find_next_bit-usage.patch @@ -0,0 +1,59 @@ +From 1137e61dcb99f7f8b54e77ed83f68b5b485a3e34 Mon Sep 17 00:00:00 2001 +From: Niklas Cassel +Date: Wed, 4 Sep 2019 18:03:38 +0200 +Subject: PCI: dwc: Fix find_next_bit() usage + +From: Niklas Cassel + +commit 1137e61dcb99f7f8b54e77ed83f68b5b485a3e34 upstream. + +find_next_bit() takes a parameter of size long, and performs arithmetic +that assumes that the argument is of size long. + +Therefore we cannot pass a u32, since this will cause find_next_bit() +to read outside the stack buffer and will produce the following print: +BUG: KASAN: stack-out-of-bounds in find_next_bit+0x38/0xb0 + +Fixes: 1b497e6493c4 ("PCI: dwc: Fix uninitialized variable in dw_handle_msi_irq()") +Tested-by: Bjorn Andersson +Signed-off-by: Niklas Cassel +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Andrew Murray +Acked-by: Gustavo Pimentel +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/controller/dwc/pcie-designware-host.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/pci/controller/dwc/pcie-designware-host.c ++++ b/drivers/pci/controller/dwc/pcie-designware-host.c +@@ -78,7 +78,8 @@ static struct msi_domain_info dw_pcie_ms + irqreturn_t dw_handle_msi_irq(struct pcie_port *pp) + { + int i, pos, irq; +- u32 val, num_ctrls; ++ unsigned long val; ++ u32 status, num_ctrls; + irqreturn_t ret = IRQ_NONE; + + num_ctrls = pp->num_vectors / MAX_MSI_IRQS_PER_CTRL; +@@ -86,14 +87,14 @@ irqreturn_t dw_handle_msi_irq(struct pci + for (i = 0; i < num_ctrls; i++) { + dw_pcie_rd_own_conf(pp, PCIE_MSI_INTR0_STATUS + + (i * MSI_REG_CTRL_BLOCK_SIZE), +- 4, &val); +- if (!val) ++ 4, &status); ++ if (!status) + continue; + + ret = IRQ_HANDLED; ++ val = status; + pos = 0; +- while ((pos = find_next_bit((unsigned long *) &val, +- MAX_MSI_IRQS_PER_CTRL, ++ while ((pos = find_next_bit(&val, MAX_MSI_IRQS_PER_CTRL, + pos)) != MAX_MSI_IRQS_PER_CTRL) { + irq = irq_find_mapping(pp->irq_domain, + (i * MAX_MSI_IRQS_PER_CTRL) + diff --git a/queue-5.4/pci-fix-missing-bridge-dma_ranges-resource-list-cleanup.patch b/queue-5.4/pci-fix-missing-bridge-dma_ranges-resource-list-cleanup.patch new file mode 100644 index 00000000000..72a3804ce3c --- /dev/null +++ b/queue-5.4/pci-fix-missing-bridge-dma_ranges-resource-list-cleanup.patch @@ -0,0 +1,36 @@ +From 7608158df3ed87a5c938c4a0b91f5b11101a9be1 Mon Sep 17 00:00:00 2001 +From: Rob Herring +Date: Mon, 7 Oct 2019 20:23:25 -0500 +Subject: PCI: Fix missing bridge dma_ranges resource list cleanup + +From: Rob Herring + +commit 7608158df3ed87a5c938c4a0b91f5b11101a9be1 upstream. + +Commit e80a91ad302b ("PCI: Add dma_ranges window list") added a +dma_ranges resource list, but failed to correctly free the list when +devm_pci_alloc_host_bridge() is used. + +Only the iproc host bridge driver is using the dma_ranges list. + +Fixes: e80a91ad302b ("PCI: Add dma_ranges window list") +Link: https://lore.kernel.org/r/20191008012325.25700-1-robh@kernel.org +Signed-off-by: Rob Herring +Signed-off-by: Bjorn Helgaas +Cc: Srinath Mannam +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/probe.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -572,6 +572,7 @@ static void devm_pci_release_host_bridge + bridge->release_fn(bridge); + + pci_free_resource_list(&bridge->windows); ++ pci_free_resource_list(&bridge->dma_ranges); + } + + static void pci_release_host_bridge_dev(struct device *dev) diff --git a/queue-5.4/pci-pm-clear-pcie-pme-status-even-for-legacy-power-management.patch b/queue-5.4/pci-pm-clear-pcie-pme-status-even-for-legacy-power-management.patch new file mode 100644 index 00000000000..78bf9d5cfb5 --- /dev/null +++ b/queue-5.4/pci-pm-clear-pcie-pme-status-even-for-legacy-power-management.patch @@ -0,0 +1,45 @@ +From ec6a75ef8e33fe33f963b916fd902c52a0be33ff Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Thu, 10 Oct 2019 16:54:36 -0500 +Subject: PCI/PM: Clear PCIe PME Status even for legacy power management + +From: Bjorn Helgaas + +commit ec6a75ef8e33fe33f963b916fd902c52a0be33ff upstream. + +Previously, pci_pm_resume_noirq() cleared the PME Status bit in the Root +Status register only if the device had no driver or the driver did not +implement legacy power management. It should clear PME Status regardless +of what sort of power management the driver supports, so do this before +checking for legacy power management. + +This affects Root Ports and Root Complex Event Collectors, for which the +usual driver is the PCIe portdrv, which implements new power management, so +this change is just on principle, not to fix any actual defects. + +Fixes: a39bd851dccf ("PCI/PM: Clear PCIe PME Status bit in core, not PCIe port driver") +Link: https://lore.kernel.org/r/20191014230016.240912-4-helgaas@kernel.org +Signed-off-by: Bjorn Helgaas +Reviewed-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pci-driver.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -941,12 +941,11 @@ static int pci_pm_resume_noirq(struct de + pci_pm_default_resume_early(pci_dev); + + pci_fixup_device(pci_fixup_resume_early, pci_dev); ++ pcie_pme_root_status_cleanup(pci_dev); + + if (pci_has_legacy_pm_support(pci_dev)) + return pci_legacy_resume_early(dev); + +- pcie_pme_root_status_cleanup(pci_dev); +- + if (drv && drv->pm && drv->pm->resume_noirq) + error = drv->pm->resume_noirq(dev); + diff --git a/queue-5.4/pci-ptm-remove-spurious-d-from-granularity-message.patch b/queue-5.4/pci-ptm-remove-spurious-d-from-granularity-message.patch new file mode 100644 index 00000000000..742f5ed76ee --- /dev/null +++ b/queue-5.4/pci-ptm-remove-spurious-d-from-granularity-message.patch @@ -0,0 +1,37 @@ +From 127a7709495db52a41012deaebbb7afc231dad91 Mon Sep 17 00:00:00 2001 +From: Bjorn Helgaas +Date: Wed, 6 Nov 2019 15:30:48 -0600 +Subject: PCI/PTM: Remove spurious "d" from granularity message + +From: Bjorn Helgaas + +commit 127a7709495db52a41012deaebbb7afc231dad91 upstream. + +The granularity message has an extra "d": + + pci 0000:02:00.0: PTM enabled, 4dns granularity + +Remove the "d" so the message is simply "PTM enabled, 4ns granularity". + +Fixes: 8b2ec318eece ("PCI: Add PTM clock granularity information") +Link: https://lore.kernel.org/r/20191106222420.10216-2-helgaas@kernel.org +Signed-off-by: Bjorn Helgaas +Reviewed-by: Andrew Murray +Cc: Jonathan Yong +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/pcie/ptm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/pcie/ptm.c ++++ b/drivers/pci/pcie/ptm.c +@@ -21,7 +21,7 @@ static void pci_ptm_info(struct pci_dev + snprintf(clock_desc, sizeof(clock_desc), ">254ns"); + break; + default: +- snprintf(clock_desc, sizeof(clock_desc), "%udns", ++ snprintf(clock_desc, sizeof(clock_desc), "%uns", + dev->ptm_granularity); + break; + } diff --git a/queue-5.4/powerpc-powernv-disable-native-pcie-port-management.patch b/queue-5.4/powerpc-powernv-disable-native-pcie-port-management.patch new file mode 100644 index 00000000000..42d7e35abf1 --- /dev/null +++ b/queue-5.4/powerpc-powernv-disable-native-pcie-port-management.patch @@ -0,0 +1,76 @@ +From 9d72dcef891030545f39ad386a30cf91df517fb2 Mon Sep 17 00:00:00 2001 +From: Oliver O'Halloran +Date: Mon, 18 Nov 2019 17:55:53 +1100 +Subject: powerpc/powernv: Disable native PCIe port management + +From: Oliver O'Halloran + +commit 9d72dcef891030545f39ad386a30cf91df517fb2 upstream. + +On PowerNV the PCIe topology is (currently) managed by the powernv platform +code in Linux in cooperation with the platform firmware. Linux's native +PCIe port service drivers operate independently of both and this can cause +problems. + +The main issue is that the portbus driver will conflict with the platform +specific hotplug driver (pnv_php) over ownership of the MSI used to notify +the host when a hotplug event occurs. The portbus driver claims this MSI on +behalf of the individual port services because the same interrupt is used +for hotplug events, PMEs (on root ports), and link bandwidth change +notifications. The portbus driver will always claim the interrupt even if +the individual port service drivers, such as pciehp, are compiled out. + +The second, bigger, problem is that the hotplug port service driver +fundamentally does not work on PowerNV. The platform assumes that all +PCI devices have a corresponding arch-specific handle derived from the DT +node for the device (pci_dn) and without one the platform will not allow +a PCI device to be enabled. This problem is largely due to historical +baggage, but it can't be resolved without significant re-factoring of the +platform PCI support. + +We can fix these problems in the interim by setting the +"pcie_ports_disabled" flag during platform initialisation. The flag +indicates the platform owns the PCIe ports which stops the portbus driver +from being registered. + +This does have the side effect of disabling all port services drivers +that is: AER, PME, BW notifications, hotplug, and DPC. However, this is +not a huge disadvantage on PowerNV since these services are either unused +or handled through other means. + +Fixes: 66725152fb9f ("PCI/hotplug: PowerPC PowerNV PCI hotplug driver") +Signed-off-by: Oliver O'Halloran +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20191118065553.30362-1-oohall@gmail.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/powernv/pci.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +--- a/arch/powerpc/platforms/powernv/pci.c ++++ b/arch/powerpc/platforms/powernv/pci.c +@@ -945,6 +945,23 @@ void __init pnv_pci_init(void) + if (!firmware_has_feature(FW_FEATURE_OPAL)) + return; + ++#ifdef CONFIG_PCIEPORTBUS ++ /* ++ * On PowerNV PCIe devices are (currently) managed in cooperation ++ * with firmware. This isn't *strictly* required, but there's enough ++ * assumptions baked into both firmware and the platform code that ++ * it's unwise to allow the portbus services to be used. ++ * ++ * We need to fix this eventually, but for now set this flag to disable ++ * the portbus driver. The AER service isn't required since that AER ++ * events are handled via EEH. The pciehp hotplug driver can't work ++ * without kernel changes (and portbus binding breaks pnv_php). The ++ * other services also require some thinking about how we're going ++ * to integrate them. ++ */ ++ pcie_ports_disabled = true; ++#endif ++ + /* Look for IODA IO-Hubs. */ + for_each_compatible_node(np, NULL, "ibm,ioda-hub") { + pnv_pci_init_ioda_hub(np); diff --git a/queue-5.4/revert-ubifs-fix-memory-leak-bug-in-alloc_ubifs_info-error-path.patch b/queue-5.4/revert-ubifs-fix-memory-leak-bug-in-alloc_ubifs_info-error-path.patch new file mode 100644 index 00000000000..ddde3ae8c10 --- /dev/null +++ b/queue-5.4/revert-ubifs-fix-memory-leak-bug-in-alloc_ubifs_info-error-path.patch @@ -0,0 +1,41 @@ +From 91cbf01178c37086b32148c53e24b04cb77557cf Mon Sep 17 00:00:00 2001 +From: Richard Weinberger +Date: Thu, 24 Oct 2019 10:25:35 +0200 +Subject: Revert "ubifs: Fix memory leak bug in alloc_ubifs_info() error path" + +From: Richard Weinberger + +commit 91cbf01178c37086b32148c53e24b04cb77557cf upstream. + +This reverts commit 9163e0184bd7d5f779934d34581843f699ad2ffd. + +At the point when ubifs_fill_super() runs, we have already a reference +to the super block. So upon deactivate_locked_super() c will get +free()'ed via ->kill_sb(). + +Cc: Wenwen Wang +Fixes: 9163e0184bd7 ("ubifs: Fix memory leak bug in alloc_ubifs_info() error path") +Reported-by: https://twitter.com/grsecurity/status/1180609139359277056 +Signed-off-by: Richard Weinberger +Tested-by: Romain Izard +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ubifs/super.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/fs/ubifs/super.c ++++ b/fs/ubifs/super.c +@@ -2267,10 +2267,8 @@ static struct dentry *ubifs_mount(struct + } + } else { + err = ubifs_fill_super(sb, data, flags & SB_SILENT ? 1 : 0); +- if (err) { +- kfree(c); ++ if (err) + goto out_deact; +- } + /* We do not support atime */ + sb->s_flags |= SB_ACTIVE; + if (IS_ENABLED(CONFIG_UBIFS_ATIME_SUPPORT)) diff --git a/queue-5.4/rtc-bd70528-add-module-alias-to-autoload-module.patch b/queue-5.4/rtc-bd70528-add-module-alias-to-autoload-module.patch new file mode 100644 index 00000000000..bae2f38750b --- /dev/null +++ b/queue-5.4/rtc-bd70528-add-module-alias-to-autoload-module.patch @@ -0,0 +1,33 @@ +From c3e12e66b14a043daac6b3d0559df80b9ed7679c Mon Sep 17 00:00:00 2001 +From: Matti Vaittinen +Date: Wed, 23 Oct 2019 14:47:11 +0300 +Subject: rtc: bd70528: Add MODULE ALIAS to autoload module + +From: Matti Vaittinen + +commit c3e12e66b14a043daac6b3d0559df80b9ed7679c upstream. + +The bd70528 RTC driver is probed by MFD driver. Add MODULE_ALIAS +in order to allow udev to load the module when MFD sub-device cell +for RTC is added. + +I'm not sure if this is a bugfix or feature addition but I guess +fixes tag won't harm in this case. + +Fixes: 32a4a4ebf768 ("rtc: bd70528: Initial support for ROHM bd70528 RTC") +Signed-off-by: Matti Vaittinen +Link: https://lore.kernel.org/r/20191023114711.GA13954@localhost.localdomain +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-bd70528.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/rtc/rtc-bd70528.c ++++ b/drivers/rtc/rtc-bd70528.c +@@ -491,3 +491,4 @@ module_platform_driver(bd70528_rtc); + MODULE_AUTHOR("Matti Vaittinen "); + MODULE_DESCRIPTION("BD70528 RTC driver"); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS("platofrm:bd70528-rtc"); diff --git a/queue-5.4/rtc-brcmstb-waketimer-add-missed-clk_disable_unprepare.patch b/queue-5.4/rtc-brcmstb-waketimer-add-missed-clk_disable_unprepare.patch new file mode 100644 index 00000000000..144398da99d --- /dev/null +++ b/queue-5.4/rtc-brcmstb-waketimer-add-missed-clk_disable_unprepare.patch @@ -0,0 +1,33 @@ +From 94303f8930ed78aea0f189b703c9d79fff9555d7 Mon Sep 17 00:00:00 2001 +From: Chuhong Yuan +Date: Wed, 6 Nov 2019 00:00:43 +0800 +Subject: rtc: brcmstb-waketimer: add missed clk_disable_unprepare + +From: Chuhong Yuan + +commit 94303f8930ed78aea0f189b703c9d79fff9555d7 upstream. + +This driver forgets to disable and unprepare clock when remove. +Add a call to clk_disable_unprepare to fix it. + +Fixes: c4f07ecee22e ("rtc: brcmstb-waketimer: Add Broadcom STB wake-timer") +Signed-off-by: Chuhong Yuan +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20191105160043.20018-1-hslester96@gmail.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-brcmstb-waketimer.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/rtc/rtc-brcmstb-waketimer.c ++++ b/drivers/rtc/rtc-brcmstb-waketimer.c +@@ -277,6 +277,7 @@ static int brcmstb_waketmr_remove(struct + struct brcmstb_waketmr *timer = dev_get_drvdata(&pdev->dev); + + unregister_reboot_notifier(&timer->reboot_notifier); ++ clk_disable_unprepare(timer->clk); + + return 0; + } diff --git a/queue-5.4/rtc-msm6242-fix-reading-of-10-hour-digit.patch b/queue-5.4/rtc-msm6242-fix-reading-of-10-hour-digit.patch new file mode 100644 index 00000000000..1e8e715e8b3 --- /dev/null +++ b/queue-5.4/rtc-msm6242-fix-reading-of-10-hour-digit.patch @@ -0,0 +1,40 @@ +From e34494c8df0cd96fc432efae121db3212c46ae48 Mon Sep 17 00:00:00 2001 +From: Kars de Jong +Date: Sat, 16 Nov 2019 12:05:48 +0100 +Subject: rtc: msm6242: Fix reading of 10-hour digit + +From: Kars de Jong + +commit e34494c8df0cd96fc432efae121db3212c46ae48 upstream. + +The driver was reading the wrong register as the 10-hour digit due to +a misplaced ')'. It was in fact reading the 1-second digit register due +to this bug. + +Also remove the use of a magic number for the hour mask and use the define +for it which was already present. + +Fixes: 4f9b9bba1dd1 ("rtc: Add an RTC driver for the Oki MSM6242") +Tested-by: Kars de Jong +Signed-off-by: Kars de Jong +Link: https://lore.kernel.org/r/20191116110548.8562-1-jongk@linux-m68k.org +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-msm6242.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/rtc/rtc-msm6242.c ++++ b/drivers/rtc/rtc-msm6242.c +@@ -133,7 +133,8 @@ static int msm6242_read_time(struct devi + msm6242_read(priv, MSM6242_SECOND1); + tm->tm_min = msm6242_read(priv, MSM6242_MINUTE10) * 10 + + msm6242_read(priv, MSM6242_MINUTE1); +- tm->tm_hour = (msm6242_read(priv, MSM6242_HOUR10 & 3)) * 10 + ++ tm->tm_hour = (msm6242_read(priv, MSM6242_HOUR10) & ++ MSM6242_HOUR10_HR_MASK) * 10 + + msm6242_read(priv, MSM6242_HOUR1); + tm->tm_mday = msm6242_read(priv, MSM6242_DAY10) * 10 + + msm6242_read(priv, MSM6242_DAY1); diff --git a/queue-5.4/rtlwifi-remove-unnecessary-null-check-in-rtl_regd_init.patch b/queue-5.4/rtlwifi-remove-unnecessary-null-check-in-rtl_regd_init.patch new file mode 100644 index 00000000000..67b1aefdca1 --- /dev/null +++ b/queue-5.4/rtlwifi-remove-unnecessary-null-check-in-rtl_regd_init.patch @@ -0,0 +1,51 @@ +From 091c6e9c083f7ebaff00b37ad13562d51464d175 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Tue, 22 Oct 2019 17:47:03 -0700 +Subject: rtlwifi: Remove unnecessary NULL check in rtl_regd_init + +From: Nathan Chancellor + +commit 091c6e9c083f7ebaff00b37ad13562d51464d175 upstream. + +When building with Clang + -Wtautological-pointer-compare: + +drivers/net/wireless/realtek/rtlwifi/regd.c:389:33: warning: comparison +of address of 'rtlpriv->regd' equal to a null pointer is always false +[-Wtautological-pointer-compare] + if (wiphy == NULL || &rtlpriv->regd == NULL) + ~~~~~~~~~^~~~ ~~~~ +1 warning generated. + +The address of an array member is never NULL unless it is the first +struct member so remove the unnecessary check. This was addressed in +the staging version of the driver in commit f986978b32b3 ("Staging: +rtlwifi: remove unnecessary NULL check"). + +While we are here, fix the following checkpatch warning: + +CHECK: Comparison to NULL could be written "!wiphy" +35: FILE: drivers/net/wireless/realtek/rtlwifi/regd.c:389: ++ if (wiphy == NULL) + +Fixes: 0c8173385e54 ("rtl8192ce: Add new driver") +Link:https://github.com/ClangBuiltLinux/linux/issues/750 +Signed-off-by: Nathan Chancellor +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/realtek/rtlwifi/regd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/realtek/rtlwifi/regd.c ++++ b/drivers/net/wireless/realtek/rtlwifi/regd.c +@@ -386,7 +386,7 @@ int rtl_regd_init(struct ieee80211_hw *h + struct wiphy *wiphy = hw->wiphy; + struct country_code_to_enum_rd *country = NULL; + +- if (wiphy == NULL || &rtlpriv->regd == NULL) ++ if (!wiphy) + return -EINVAL; + + /* init country_code from efuse channel plan */ diff --git a/queue-5.4/sch_cake-add-missing-nla-policy-entry-tca_cake_split_gso.patch b/queue-5.4/sch_cake-add-missing-nla-policy-entry-tca_cake_split_gso.patch new file mode 100644 index 00000000000..7fd2141d8d1 --- /dev/null +++ b/queue-5.4/sch_cake-add-missing-nla-policy-entry-tca_cake_split_gso.patch @@ -0,0 +1,35 @@ +From b3c424eb6a1a3c485de64619418a471dee6ce849 Mon Sep 17 00:00:00 2001 +From: Victorien Molle +Date: Mon, 2 Dec 2019 15:11:38 +0100 +Subject: sch_cake: Add missing NLA policy entry TCA_CAKE_SPLIT_GSO +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Victorien Molle + +commit b3c424eb6a1a3c485de64619418a471dee6ce849 upstream. + +This field has never been checked since introduction in mainline kernel + +Signed-off-by: Victorien Molle +Signed-off-by: Florent Fourcot +Fixes: 2db6dc2662ba "sch_cake: Make gso-splitting configurable from userspace" +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/sched/sch_cake.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/sched/sch_cake.c ++++ b/net/sched/sch_cake.c +@@ -2184,6 +2184,7 @@ static const struct nla_policy cake_poli + [TCA_CAKE_MPU] = { .type = NLA_U32 }, + [TCA_CAKE_INGRESS] = { .type = NLA_U32 }, + [TCA_CAKE_ACK_FILTER] = { .type = NLA_U32 }, ++ [TCA_CAKE_SPLIT_GSO] = { .type = NLA_U32 }, + [TCA_CAKE_FWMARK] = { .type = NLA_U32 }, + }; + diff --git a/queue-5.4/scsi-sd-enable-compat-ioctls-for-sed-opal.patch b/queue-5.4/scsi-sd-enable-compat-ioctls-for-sed-opal.patch new file mode 100644 index 00000000000..8349ea30197 --- /dev/null +++ b/queue-5.4/scsi-sd-enable-compat-ioctls-for-sed-opal.patch @@ -0,0 +1,61 @@ +From 142b2ac82e31c174936c5719fa12ae28f51a55b7 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 15 Mar 2019 13:46:11 +0100 +Subject: scsi: sd: enable compat ioctls for sed-opal + +From: Arnd Bergmann + +commit 142b2ac82e31c174936c5719fa12ae28f51a55b7 upstream. + +The sed_ioctl() function is written to be compatible between +32-bit and 64-bit processes, however compat mode is only +wired up for nvme, not for sd. + +Add the missing call to sed_ioctl() in sd_compat_ioctl(). + +Fixes: d80210f25ff0 ("sd: add support for TCG OPAL self encrypting disks") +Cc: linux-scsi@vger.kernel.org +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/sd.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1694,20 +1694,30 @@ static void sd_rescan(struct device *dev + static int sd_compat_ioctl(struct block_device *bdev, fmode_t mode, + unsigned int cmd, unsigned long arg) + { +- struct scsi_device *sdev = scsi_disk(bdev->bd_disk)->device; ++ struct gendisk *disk = bdev->bd_disk; ++ struct scsi_disk *sdkp = scsi_disk(disk); ++ struct scsi_device *sdev = sdkp->device; ++ void __user *p = compat_ptr(arg); + int error; + ++ error = scsi_verify_blk_ioctl(bdev, cmd); ++ if (error < 0) ++ return error; ++ + error = scsi_ioctl_block_when_processing_errors(sdev, cmd, + (mode & FMODE_NDELAY) != 0); + if (error) + return error; ++ ++ if (is_sed_ioctl(cmd)) ++ return sed_ioctl(sdkp->opal_dev, cmd, p); + + /* + * Let the static ioctl translation table take care of it. + */ + if (!sdev->host->hostt->compat_ioctl) + return -ENOIOCTLCMD; +- return sdev->host->hostt->compat_ioctl(sdev, cmd, (void __user *)arg); ++ return sdev->host->hostt->compat_ioctl(sdev, cmd, p); + } + #endif + diff --git a/queue-5.4/series b/queue-5.4/series index 88e053c32f6..9ec3e4bdd03 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -124,3 +124,57 @@ pci-pciehp-do-not-disable-interrupt-twice-on-suspend.patch revert-drm-virtio-switch-virtio_gpu_wait_ioctl-to-gem-helper.patch drm-amdgpu-cleanup-creating-bos-at-fixed-location-v2.patch drm-amdgpu-discovery-reserve-discovery-data-at-the-top-of-vram.patch +scsi-sd-enable-compat-ioctls-for-sed-opal.patch +arm64-dts-apq8096-db820c-increase-load-on-l21-for-sdcard.patch +gfs2-add-compat_ioctl-support.patch +af_unix-add-compat_ioctl-support.patch +compat_ioctl-handle-siocoutqnsd.patch +pci-aardvark-use-ltssm-state-to-build-link-training-flag.patch +pci-aardvark-fix-pci_exp_rtctl-register-configuration.patch +pci-dwc-fix-find_next_bit-usage.patch +pci-fix-missing-bridge-dma_ranges-resource-list-cleanup.patch +pci-pm-clear-pcie-pme-status-even-for-legacy-power-management.patch +tools-pci-fix-fd-leakage.patch +pci-ptm-remove-spurious-d-from-granularity-message.patch +powerpc-powernv-disable-native-pcie-port-management.patch +mips-pci-remember-nasid-changed-by-set-interrupt-affinity.patch +mips-loongson-fix-return-value-of-loongson_hwmon_init.patch +mips-sgi-ip27-fix-crash-when-cpus-are-disabled-via-nr_cpus-parameter.patch +tty-serial-imx-use-the-sg-count-from-dma_map_sg.patch +tty-serial-pch_uart-correct-usage-of-dma_unmap_sg.patch +arm-8943-1-fix-topology-setup-in-case-of-cpu-hotplug-for-config_sched_mc.patch +media-ov6650-fix-incorrect-use-of-jpeg-colorspace.patch +media-ov6650-fix-some-format-attributes-not-under-control.patch +media-ov6650-fix-.get_fmt-v4l2_subdev_format_try-support.patch +media-ov6650-fix-default-format-not-applied-on-device-probe.patch +media-rcar-vin-fix-incorrect-return-statement-in-rvin_try_format.patch +media-hantro-h264-fix-the-frame_num-wraparound-case.patch +media-v4l-cadence-fix-how-unsued-lanes-are-handled-in-csi2rx_start.patch +media-exynos4-is-fix-recursive-locking-in-isp_video_release.patch +media-coda-fix-deadlock-between-decoder-picture-run-and-start-command.patch +media-cedrus-use-correct-h264-8x8-scaling-list.patch +media-hantro-do-not-reorder-h264-scaling-list.patch +media-aspeed-video-fix-memory-leaks-in-aspeed_video_probe.patch +media-hantro-set-h264-fieldpic_flag_e-flag-correctly.patch +iommu-mediatek-correct-the-flush_iotlb_all-callback.patch +iommu-mediatek-add-a-new-tlb_lock-for-tlb_flush.patch +memory-mtk-smi-add-pm-suspend-and-resume-ops.patch +revert-ubifs-fix-memory-leak-bug-in-alloc_ubifs_info-error-path.patch +ubifs-fixed-missed-le64_to_cpu-in-journal.patch +ubifs-do_kill_orphans-fix-a-memory-leak-bug.patch +spi-sprd-fix-the-incorrect-spi-register.patch +mtd-spi-nor-fix-silent-truncation-in-spi_nor_read.patch +mtd-spi-nor-fix-silent-truncation-in-spi_nor_read_raw.patch +spi-pxa2xx-set-controller-max_transfer_size-in-dma-mode.patch +spi-atmel-fix-handling-of-cs_change-set-on-non-last-xfer.patch +spi-rspi-use-platform_get_irq_byname_optional-for-optional-irqs.patch +spi-lpspi-fix-memory-leak-in-fsl_lpspi_probe.patch +iwlwifi-mvm-consider-ieee80211-station-max-amsdu-value.patch +rtlwifi-remove-unnecessary-null-check-in-rtl_regd_init.patch +iwlwifi-mvm-fix-support-for-single-antenna-diversity.patch +sch_cake-add-missing-nla-policy-entry-tca_cake_split_gso.patch +f2fs-fix-potential-overflow.patch +nfsd-fixing-possible-null-pointer-derefering-in-copy-offload.patch +rtc-msm6242-fix-reading-of-10-hour-digit.patch +rtc-brcmstb-waketimer-add-missed-clk_disable_unprepare.patch +rtc-bd70528-add-module-alias-to-autoload-module.patch diff --git a/queue-5.4/spi-atmel-fix-handling-of-cs_change-set-on-non-last-xfer.patch b/queue-5.4/spi-atmel-fix-handling-of-cs_change-set-on-non-last-xfer.patch new file mode 100644 index 00000000000..0aeb42a3172 --- /dev/null +++ b/queue-5.4/spi-atmel-fix-handling-of-cs_change-set-on-non-last-xfer.patch @@ -0,0 +1,63 @@ +From fed8d8c7a6dc2a76d7764842853d81c770b0788e Mon Sep 17 00:00:00 2001 +From: Mans Rullgard +Date: Fri, 18 Oct 2019 17:35:04 +0200 +Subject: spi: atmel: fix handling of cs_change set on non-last xfer + +From: Mans Rullgard + +commit fed8d8c7a6dc2a76d7764842853d81c770b0788e upstream. + +The driver does the wrong thing when cs_change is set on a non-last +xfer in a message. When cs_change is set, the driver deactivates the +CS and leaves it off until a later xfer again has cs_change set whereas +it should be briefly toggling CS off and on again. + +This patch brings the behaviour of the driver back in line with the +documentation and common sense. The delay of 10 us is the same as is +used by the default spi_transfer_one_message() function in spi.c. +[gregory: rebased on for-5.5 from spi tree] +Fixes: 8090d6d1a415 ("spi: atmel: Refactor spi-atmel to use SPI framework queue") +Signed-off-by: Mans Rullgard +Acked-by: Nicolas Ferre +Signed-off-by: Gregory CLEMENT +Link: https://lore.kernel.org/r/20191018153504.4249-1-gregory.clement@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-atmel.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -302,7 +302,6 @@ struct atmel_spi { + bool use_cs_gpios; + + bool keep_cs; +- bool cs_active; + + u32 fifo_size; + }; +@@ -1374,11 +1373,9 @@ static int atmel_spi_one_transfer(struct + &msg->transfers)) { + as->keep_cs = true; + } else { +- as->cs_active = !as->cs_active; +- if (as->cs_active) +- cs_activate(as, msg->spi); +- else +- cs_deactivate(as, msg->spi); ++ cs_deactivate(as, msg->spi); ++ udelay(10); ++ cs_activate(as, msg->spi); + } + } + +@@ -1401,7 +1398,6 @@ static int atmel_spi_transfer_one_messag + atmel_spi_lock(as); + cs_activate(as, spi); + +- as->cs_active = true; + as->keep_cs = false; + + msg->status = 0; diff --git a/queue-5.4/spi-lpspi-fix-memory-leak-in-fsl_lpspi_probe.patch b/queue-5.4/spi-lpspi-fix-memory-leak-in-fsl_lpspi_probe.patch new file mode 100644 index 00000000000..068aa47e4a4 --- /dev/null +++ b/queue-5.4/spi-lpspi-fix-memory-leak-in-fsl_lpspi_probe.patch @@ -0,0 +1,36 @@ +From 057b8945f78f76d0b04eeb5c27cd9225e5e7ad86 Mon Sep 17 00:00:00 2001 +From: Navid Emamdoost +Date: Sun, 29 Sep 2019 22:46:01 -0500 +Subject: spi: lpspi: fix memory leak in fsl_lpspi_probe + +From: Navid Emamdoost + +commit 057b8945f78f76d0b04eeb5c27cd9225e5e7ad86 upstream. + +In fsl_lpspi_probe an SPI controller is allocated either via +spi_alloc_slave or spi_alloc_master. In all but one error cases this +controller is put by going to error handling code. This commit fixes the +case when pm_runtime_get_sync fails and it should go to the error +handling path. + +Fixes: 944c01a889d9 ("spi: lpspi: enable runtime pm for lpspi") +Signed-off-by: Navid Emamdoost +Link: https://lore.kernel.org/r/20190930034602.1467-1-navid.emamdoost@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-fsl-lpspi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-fsl-lpspi.c ++++ b/drivers/spi/spi-fsl-lpspi.c +@@ -938,7 +938,7 @@ static int fsl_lpspi_probe(struct platfo + ret = pm_runtime_get_sync(fsl_lpspi->dev); + if (ret < 0) { + dev_err(fsl_lpspi->dev, "failed to enable clock\n"); +- return ret; ++ goto out_controller_put; + } + + temp = readl(fsl_lpspi->base + IMX7ULP_PARAM); diff --git a/queue-5.4/spi-pxa2xx-set-controller-max_transfer_size-in-dma-mode.patch b/queue-5.4/spi-pxa2xx-set-controller-max_transfer_size-in-dma-mode.patch new file mode 100644 index 00000000000..90a10d5c4bb --- /dev/null +++ b/queue-5.4/spi-pxa2xx-set-controller-max_transfer_size-in-dma-mode.patch @@ -0,0 +1,76 @@ +From b2662a164f9dc48da8822e56600686d639056282 Mon Sep 17 00:00:00 2001 +From: Daniel Vetter +Date: Thu, 17 Oct 2019 08:44:26 +0200 +Subject: spi: pxa2xx: Set controller->max_transfer_size in dma mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Vetter + +commit b2662a164f9dc48da8822e56600686d639056282 upstream. + +In DMA mode we have a maximum transfer size, past that the driver +falls back to PIO (see the check at the top of pxa2xx_spi_transfer_one). +Falling back to PIO for big transfers defeats the point of a dma engine, +hence set the max transfer size to inform spi clients that they need +to do something smarter. + +This was uncovered by the drm_mipi_dbi spi panel code, which does +large spi transfers, but stopped splitting them after: + +commit e143364b4c1774f68e923a5a0bb0fca28ac25888 +Author: Noralf Trønnes +Date: Fri Jul 19 17:59:10 2019 +0200 + + drm/tinydrm: Remove tinydrm_spi_max_transfer_size() + +After this commit the code relied on the spi core to split transfers +into max dma-able blocks, which also papered over the PIO fallback issue. + +Fix this by setting the overall max transfer size to the DMA limit, +but only when the controller runs in DMA mode. + +Fixes: e143364b4c17 ("drm/tinydrm: Remove tinydrm_spi_max_transfer_size()") +Cc: Sam Ravnborg +Cc: Noralf Trønnes +Cc: Andy Shevchenko +Reported-and-tested-by: Andy Shevchenko +Cc: Daniel Mack +Cc: Haojian Zhuang +Cc: Robert Jarzmik +Cc: Mark Brown +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-spi@vger.kernel.org +Signed-off-by: Daniel Vetter +Link: https://lore.kernel.org/r/20191017064426.30814-1-daniel.vetter@ffwll.ch +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-pxa2xx.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1612,6 +1612,11 @@ static int pxa2xx_spi_fw_translate_cs(st + return cs; + } + ++static size_t pxa2xx_spi_max_dma_transfer_size(struct spi_device *spi) ++{ ++ return MAX_DMA_LEN; ++} ++ + static int pxa2xx_spi_probe(struct platform_device *pdev) + { + struct device *dev = &pdev->dev; +@@ -1717,6 +1722,8 @@ static int pxa2xx_spi_probe(struct platf + } else { + controller->can_dma = pxa2xx_spi_can_dma; + controller->max_dma_len = MAX_DMA_LEN; ++ controller->max_transfer_size = ++ pxa2xx_spi_max_dma_transfer_size; + } + } + diff --git a/queue-5.4/spi-rspi-use-platform_get_irq_byname_optional-for-optional-irqs.patch b/queue-5.4/spi-rspi-use-platform_get_irq_byname_optional-for-optional-irqs.patch new file mode 100644 index 00000000000..622ba10c3f1 --- /dev/null +++ b/queue-5.4/spi-rspi-use-platform_get_irq_byname_optional-for-optional-irqs.patch @@ -0,0 +1,56 @@ +From 2de860b4a7a0bd5a4b5bd3bff0e6a615495df4ba Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Wed, 16 Oct 2019 16:31:01 +0200 +Subject: spi: rspi: Use platform_get_irq_byname_optional() for optional irqs + +From: Geert Uytterhoeven + +commit 2de860b4a7a0bd5a4b5bd3bff0e6a615495df4ba upstream. + +As platform_get_irq_byname() now prints an error when the interrupt +does not exist, scary warnings may be printed for optional interrupts: + + renesas_spi e6b10000.spi: IRQ rx not found + renesas_spi e6b10000.spi: IRQ mux not found + +Fix this by calling platform_get_irq_byname_optional() instead. +Remove the no longer needed printing of platform_get_irq errors, as the +remaining calls to platform_get_irq() and platform_get_irq_byname() take +care of that. + +Fixes: 7723f4c5ecdb8d83 ("driver core: platform: Add an error message to platform_get_irq*()") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/20191016143101.28738-1-geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-rspi.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/spi/spi-rspi.c ++++ b/drivers/spi/spi-rspi.c +@@ -1257,9 +1257,9 @@ static int rspi_probe(struct platform_de + ctlr->flags = ops->flags; + ctlr->dev.of_node = pdev->dev.of_node; + +- ret = platform_get_irq_byname(pdev, "rx"); ++ ret = platform_get_irq_byname_optional(pdev, "rx"); + if (ret < 0) { +- ret = platform_get_irq_byname(pdev, "mux"); ++ ret = platform_get_irq_byname_optional(pdev, "mux"); + if (ret < 0) + ret = platform_get_irq(pdev, 0); + if (ret >= 0) +@@ -1270,10 +1270,6 @@ static int rspi_probe(struct platform_de + if (ret >= 0) + rspi->tx_irq = ret; + } +- if (ret < 0) { +- dev_err(&pdev->dev, "platform_get_irq error\n"); +- goto error2; +- } + + if (rspi->rx_irq == rspi->tx_irq) { + /* Single multiplexed interrupt */ diff --git a/queue-5.4/spi-sprd-fix-the-incorrect-spi-register.patch b/queue-5.4/spi-sprd-fix-the-incorrect-spi-register.patch new file mode 100644 index 00000000000..69396ec3626 --- /dev/null +++ b/queue-5.4/spi-sprd-fix-the-incorrect-spi-register.patch @@ -0,0 +1,34 @@ +From 5e9c5236b7b86779b53b762f7e66240c3f18314b Mon Sep 17 00:00:00 2001 +From: Huanpeng Xin +Date: Wed, 4 Dec 2019 15:13:59 +0800 +Subject: spi: sprd: Fix the incorrect SPI register + +From: Huanpeng Xin + +commit 5e9c5236b7b86779b53b762f7e66240c3f18314b upstream. + +The original code used an incorrect SPI register to initialize the SPI +controller in sprd_spi_init_hw(), thus fix it. + +Fixes: e7d973a31c24 ("spi: sprd: Add SPI driver for Spreadtrum SC9860") +Signed-off-by: Huanpeng Xin +Signed-off-by: Baolin Wang +Link: https://lore.kernel.org/r/b4f7f89ec0fdc595335687bfbd9f962213bc4a1d.1575443510.git.baolin.wang7@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/spi-sprd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/spi/spi-sprd.c ++++ b/drivers/spi/spi-sprd.c +@@ -674,7 +674,7 @@ static void sprd_spi_init_hw(struct sprd + u16 word_delay, interval; + u32 val; + +- val = readl_relaxed(ss->base + SPRD_SPI_CTL7); ++ val = readl_relaxed(ss->base + SPRD_SPI_CTL0); + val &= ~(SPRD_SPI_SCK_REV | SPRD_SPI_NG_TX | SPRD_SPI_NG_RX); + /* Set default chip selection, clock phase and clock polarity */ + val |= ss->hw_mode & SPI_CPHA ? SPRD_SPI_NG_RX : SPRD_SPI_NG_TX; diff --git a/queue-5.4/tools-pci-fix-fd-leakage.patch b/queue-5.4/tools-pci-fix-fd-leakage.patch new file mode 100644 index 00000000000..3e4820422e5 --- /dev/null +++ b/queue-5.4/tools-pci-fix-fd-leakage.patch @@ -0,0 +1,31 @@ +From 3c379a59b4795d7279d38c623e74b9790345a32b Mon Sep 17 00:00:00 2001 +From: Hewenliang +Date: Fri, 25 Oct 2019 21:35:55 -0400 +Subject: tools: PCI: Fix fd leakage + +From: Hewenliang + +commit 3c379a59b4795d7279d38c623e74b9790345a32b upstream. + +We should close fd before the return of run_test. + +Fixes: 3f2ed8134834 ("tools: PCI: Add a userspace tool to test PCI endpoint") +Signed-off-by: Hewenliang +Signed-off-by: Lorenzo Pieralisi +Acked-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + tools/pci/pcitest.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/tools/pci/pcitest.c ++++ b/tools/pci/pcitest.c +@@ -129,6 +129,7 @@ static int run_test(struct pci_test *tes + } + + fflush(stdout); ++ close(fd); + return (ret < 0) ? ret : 1 - ret; /* return 0 if test succeeded */ + } + diff --git a/queue-5.4/tty-serial-imx-use-the-sg-count-from-dma_map_sg.patch b/queue-5.4/tty-serial-imx-use-the-sg-count-from-dma_map_sg.patch new file mode 100644 index 00000000000..39f18db7415 --- /dev/null +++ b/queue-5.4/tty-serial-imx-use-the-sg-count-from-dma_map_sg.patch @@ -0,0 +1,33 @@ +From 596fd8dffb745afcebc0ec6968e17fe29f02044c Mon Sep 17 00:00:00 2001 +From: Peng Fan +Date: Thu, 7 Nov 2019 06:42:53 +0000 +Subject: tty: serial: imx: use the sg count from dma_map_sg + +From: Peng Fan + +commit 596fd8dffb745afcebc0ec6968e17fe29f02044c upstream. + +The dmaengine_prep_slave_sg needs to use sg count returned +by dma_map_sg, not use sport->dma_tx_nents, because the return +value of dma_map_sg is not always same with "nents". + +Fixes: b4cdc8f61beb ("serial: imx: add DMA support for imx6q") +Signed-off-by: Peng Fan +Link: https://lore.kernel.org/r/1573108875-26530-1-git-send-email-peng.fan@nxp.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/imx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -619,7 +619,7 @@ static void imx_uart_dma_tx(struct imx_p + dev_err(dev, "DMA mapping error for TX.\n"); + return; + } +- desc = dmaengine_prep_slave_sg(chan, sgl, sport->dma_tx_nents, ++ desc = dmaengine_prep_slave_sg(chan, sgl, ret, + DMA_MEM_TO_DEV, DMA_PREP_INTERRUPT); + if (!desc) { + dma_unmap_sg(dev, sgl, sport->dma_tx_nents, diff --git a/queue-5.4/tty-serial-pch_uart-correct-usage-of-dma_unmap_sg.patch b/queue-5.4/tty-serial-pch_uart-correct-usage-of-dma_unmap_sg.patch new file mode 100644 index 00000000000..ec1ddbfe294 --- /dev/null +++ b/queue-5.4/tty-serial-pch_uart-correct-usage-of-dma_unmap_sg.patch @@ -0,0 +1,65 @@ +From 74887542fdcc92ad06a48c0cca17cdf09fc8aa00 Mon Sep 17 00:00:00 2001 +From: Peng Fan +Date: Wed, 13 Nov 2019 05:37:42 +0000 +Subject: tty: serial: pch_uart: correct usage of dma_unmap_sg + +From: Peng Fan + +commit 74887542fdcc92ad06a48c0cca17cdf09fc8aa00 upstream. + +Per Documentation/DMA-API-HOWTO.txt, +To unmap a scatterlist, just call: + dma_unmap_sg(dev, sglist, nents, direction); + +.. note:: + + The 'nents' argument to the dma_unmap_sg call must be + the _same_ one you passed into the dma_map_sg call, + it should _NOT_ be the 'count' value _returned_ from the + dma_map_sg call. + +However in the driver, priv->nent is directly assigned with value +returned from dma_map_sg, and dma_unmap_sg use priv->nent for unmap, +this breaks the API usage. + +So introduce a new entry orig_nent to remember 'nents'. + +Fixes: da3564ee027e ("pch_uart: add multi-scatter processing") +Signed-off-by: Peng Fan +Link: https://lore.kernel.org/r/1573623259-6339-1-git-send-email-peng.fan@nxp.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/pch_uart.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/pch_uart.c ++++ b/drivers/tty/serial/pch_uart.c +@@ -233,6 +233,7 @@ struct eg20t_port { + struct dma_chan *chan_rx; + struct scatterlist *sg_tx_p; + int nent; ++ int orig_nent; + struct scatterlist sg_rx; + int tx_dma_use; + void *rx_buf_virt; +@@ -787,9 +788,10 @@ static void pch_dma_tx_complete(void *ar + } + xmit->tail &= UART_XMIT_SIZE - 1; + async_tx_ack(priv->desc_tx); +- dma_unmap_sg(port->dev, sg, priv->nent, DMA_TO_DEVICE); ++ dma_unmap_sg(port->dev, sg, priv->orig_nent, DMA_TO_DEVICE); + priv->tx_dma_use = 0; + priv->nent = 0; ++ priv->orig_nent = 0; + kfree(priv->sg_tx_p); + pch_uart_hal_enable_interrupt(priv, PCH_UART_HAL_TX_INT); + } +@@ -1010,6 +1012,7 @@ static unsigned int dma_handle_tx(struct + dev_err(priv->port.dev, "%s:dma_map_sg Failed\n", __func__); + return 0; + } ++ priv->orig_nent = num; + priv->nent = nent; + + for (i = 0; i < nent; i++, sg++) { diff --git a/queue-5.4/ubifs-do_kill_orphans-fix-a-memory-leak-bug.patch b/queue-5.4/ubifs-do_kill_orphans-fix-a-memory-leak-bug.patch new file mode 100644 index 00000000000..71631424e5e --- /dev/null +++ b/queue-5.4/ubifs-do_kill_orphans-fix-a-memory-leak-bug.patch @@ -0,0 +1,69 @@ +From 10256f000932f12596dc043cf880ecf488a32510 Mon Sep 17 00:00:00 2001 +From: Zhihao Cheng +Date: Tue, 29 Oct 2019 20:58:23 +0800 +Subject: ubifs: do_kill_orphans: Fix a memory leak bug + +From: Zhihao Cheng + +commit 10256f000932f12596dc043cf880ecf488a32510 upstream. + +If there are more than one valid snod on the sleb->nodes list, +do_kill_orphans will malloc ino more than once without releasing +previous ino's memory. Finally, it will trigger memory leak. + +Fixes: ee1438ce5dc4 ("ubifs: Check link count of inodes when...") +Signed-off-by: Zhihao Cheng +Signed-off-by: zhangyi (F) +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ubifs/orphan.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/fs/ubifs/orphan.c ++++ b/fs/ubifs/orphan.c +@@ -631,12 +631,17 @@ static int do_kill_orphans(struct ubifs_ + ino_t inum; + int i, n, err, first = 1; + ++ ino = kmalloc(UBIFS_MAX_INO_NODE_SZ, GFP_NOFS); ++ if (!ino) ++ return -ENOMEM; ++ + list_for_each_entry(snod, &sleb->nodes, list) { + if (snod->type != UBIFS_ORPH_NODE) { + ubifs_err(c, "invalid node type %d in orphan area at %d:%d", + snod->type, sleb->lnum, snod->offs); + ubifs_dump_node(c, snod->node); +- return -EINVAL; ++ err = -EINVAL; ++ goto out_free; + } + + orph = snod->node; +@@ -663,20 +668,18 @@ static int do_kill_orphans(struct ubifs_ + ubifs_err(c, "out of order commit number %llu in orphan node at %d:%d", + cmt_no, sleb->lnum, snod->offs); + ubifs_dump_node(c, snod->node); +- return -EINVAL; ++ err = -EINVAL; ++ goto out_free; + } + dbg_rcvry("out of date LEB %d", sleb->lnum); + *outofdate = 1; +- return 0; ++ err = 0; ++ goto out_free; + } + + if (first) + first = 0; + +- ino = kmalloc(UBIFS_MAX_INO_NODE_SZ, GFP_NOFS); +- if (!ino) +- return -ENOMEM; +- + n = (le32_to_cpu(orph->ch.len) - UBIFS_ORPH_NODE_SZ) >> 3; + for (i = 0; i < n; i++) { + union ubifs_key key1, key2; diff --git a/queue-5.4/ubifs-fixed-missed-le64_to_cpu-in-journal.patch b/queue-5.4/ubifs-fixed-missed-le64_to_cpu-in-journal.patch new file mode 100644 index 00000000000..40696a03c4c --- /dev/null +++ b/queue-5.4/ubifs-fixed-missed-le64_to_cpu-in-journal.patch @@ -0,0 +1,40 @@ +From df22b5b3ecc6233e33bd27f67f14c0cd1b5a5897 Mon Sep 17 00:00:00 2001 +From: "Ben Dooks (Codethink)" +Date: Wed, 16 Oct 2019 11:08:03 +0100 +Subject: ubifs: Fixed missed le64_to_cpu() in journal + +From: Ben Dooks (Codethink) + +commit df22b5b3ecc6233e33bd27f67f14c0cd1b5a5897 upstream. + +In the ubifs_jnl_write_inode() functon, it calls ubifs_iget() +with xent->inum. The xent->inum is __le64, but the ubifs_iget() +takes native cpu endian. + +I think that this should be changed to passing le64_to_cpu(xent->inum) +to fix the following sparse warning: + +fs/ubifs/journal.c:902:58: warning: incorrect type in argument 2 (different base types) +fs/ubifs/journal.c:902:58: expected unsigned long inum +fs/ubifs/journal.c:902:58: got restricted __le64 [usertype] inum + +Fixes: 7959cf3a7506 ("ubifs: journal: Handle xattrs like files") +Signed-off-by: Ben Dooks +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ubifs/journal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ubifs/journal.c ++++ b/fs/ubifs/journal.c +@@ -899,7 +899,7 @@ int ubifs_jnl_write_inode(struct ubifs_i + fname_name(&nm) = xent->name; + fname_len(&nm) = le16_to_cpu(xent->nlen); + +- xino = ubifs_iget(c->vfs_sb, xent->inum); ++ xino = ubifs_iget(c->vfs_sb, le64_to_cpu(xent->inum)); + if (IS_ERR(xino)) { + err = PTR_ERR(xino); + ubifs_err(c, "dead directory entry '%s', error %d",